Description

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-21T07:16:53.993Z",
  "pubdate": "2026-09-21T07:16:53.993Z",
  "executiveSummary": "A critical security vulnerability exists in the BioStar BIOS Update Utility version 1.9.7.3, specifically within the BSMEM64_W10.sys kernel-mode driver.\nThe vulnerability is categorized as an arbitrary write-what-where primitive, resulting from improper validation of input parameters handled by the IOCTL (Input/Output Control) interface.\nThis flaw allows a local, low-privileged attacker to write arbitrary data to arbitrary physical memory addresses.\nBy gaining the ability to write to kernel memory, an attacker can escalate privileges, bypass security features such as PatchGuard, or execute arbitrary code at the highest privilege level (Ring 0).\nExploitation requires local access to the target system, and because a functional exploit is publicly available, the risk is elevated.\nThe vendor has not responded to disclosure attempts, leaving the vulnerability unpatched and systems potentially exposed.",
  "technicalDetails": "The vulnerability resides within the IOCTL handler logic of the BSMEM64_W10.sys driver, specifically within the function sub_110BC. This driver is designed to provide user-mode applications with the capability to perform low-level memory operations, a common requirement for BIOS update utilities that necessitate direct hardware interaction.\nThe root cause is a lack of sufficient input validation on user-supplied parameters provided via an IOCTL request. Specifically, the function sub_110BC fails to verify the target 'PhysicalAddress' and the associated 'Size' parameters passed by the user-mode application. Because the driver performs these operations with kernel-level privileges, the lack of boundary checking allows an attacker to manipulate memory maps or kernel structures.\nThe attack flow follows a structured path: First, an attacker obtains a handle to the device object associated with BSMEM64_W10.sys using the CreateFile API. Second, the attacker constructs a malicious IOCTL request buffer containing the target physical memory address and the data to be written. Third, the attacker calls DeviceIoControl to pass this buffer to the driver. Fourth, the driver's sub_110BC function processes the request without sanitizing the address or size, effectively performing a 'write-what-where' operation.\nBy targeting specific kernel memory regions, such as the System Service Descriptor Table (SSDT), Interrupt Descriptor Table (IDT), or kernel object structures, the attacker can hijack execution flow. This bypasses typical user-mode security controls. The exploitation is entirely local, as the driver exposes its interface to local users, allowing any account with sufficient permissions to open the device handle to trigger the vulnerability. Given that the exploit code is already public, the barrier to entry is low, making it trivial for an adversary to gain full control over the operating system kernel, leading to persistent malware installation, disablement of Endpoint Detection and Response (EDR) solutions, or full system compromise."
}