Description

A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of the file BS_HWMIO64_W10.sys of the component IOCTL Handler. Such manipulation of the argument PhysicalAddress leads to write-what-where condition. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T05:16:42.053Z",
  "pubdate": "2026-09-21T05:16:42.053Z",
  "executiveSummary": "A critical security vulnerability exists within the BioStar Temperature Monitor Utility 1.2.1806.2200, specifically residing in the BS_HWMIO64_W10.sys kernel driver.\nThe vulnerability is identified as a write-what-where condition resulting from improper input validation within the IOCTL handler function sub_1105C.\nThis flaw allows a local, authenticated attacker to gain unauthorized read/write access to arbitrary physical memory addresses.\nBy manipulating the PhysicalAddress argument passed through the IOCTL interface, an attacker can overwrite kernel-mode structures or execute arbitrary code with elevated system privileges.\nGiven the nature of kernel-level memory corruption, successful exploitation typically results in full system compromise, including the ability to disable security software, bypass kernel-mode code signing, or establish persistent backdoors.\nThe attack requires local access to the system and is facilitated by the driver's failure to sanitize user-supplied buffers before performing memory operations.\nThe vendor has been notified of this vulnerability but has remained unresponsive, leaving systems deployed in production environments exposed to active exploitation due to the public availability of exploit code.",
  "technicalDetails": "The vulnerability is located in the kernel-mode driver file BS_HWMIO64_W10.sys, specifically within the IOCTL dispatch routine handler, identified as function sub_1105C.\nThe root cause of the vulnerability is an insufficient validation process when handling Input/Output Control (IOCTL) codes. Specifically, the driver accepts a user-provided structure containing a PhysicalAddress field without performing bounds checking or origin verification.\nThe sub_1105C function maps or accesses this user-supplied physical address directly into the kernel memory space to perform a write operation. Because the driver operates at Ring 0, it lacks the hardware-enforced memory isolation that prevents user-mode applications from accessing privileged memory regions.\nAn attacker can exploit this by crafting a malicious IOCTL request. The attack flow involves: 1) Opening a handle to the device object associated with the BS_HWMIO64_W10.sys driver using CreateFile; 2) Preparing a buffer containing the target PhysicalAddress and the desired data to be written; 3) Invoking DeviceIoControl with the specific control code handled by sub_1105C.\nUpon receiving the request, the driver passes the attacker-controlled PhysicalAddress to its internal memory-writing logic. Because there are no checks to ensure the address resides within a safe, non-critical memory range, the driver executes a write-what-where primitive.\nThis allows the attacker to overwrite sensitive kernel data, such as system call tables, object header flags, or process tokens (e.g., swapping the current process token with that of the SYSTEM process).\nPost-exploitation impact is severe, as the attacker effectively bypasses standard Windows kernel security mitigations, such as Kernel Mode Code Signing (KMCS) and PatchGuard, by modifying critical kernel structures in memory.\nSince the exploit code is publicly disclosed, the barrier to entry for local threat actors is significantly lowered. The vulnerability does not require network exposure, but it does require the attacker to have already achieved initial local code execution on the target system to interface with the driver handle."
}