Description

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WIN_CERTIFICATE data ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4") instead of parsing and validating the PKCS signature data. As a result, a local unprivileged attacker may bypass this via crafted certificate data and obtain access to privileged IOCTL functionality.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.1",
  "pubDate": "2026-09-25T04:17:50.537Z",
  "pubdate": "2026-09-25T04:17:50.537Z",
  "executiveSummary": "The IRONMACE Ironshield kernel-mode driver (tvk.sys) version 1.0.0.167 contains a critical security vulnerability stemming from improper input validation during the client authentication process.\nRather than performing cryptographically secure validation of PKCS signature data, the driver relies on insecure string matching against embedded metadata fields.\nThis flaw allows a local, unprivileged attacker to bypass client integrity checks by crafting malicious executables that contain the expected 'IRONMACE Co., Ltd.' and 'DigiCert Trusted Root G4' strings within the WIN_CERTIFICATE data structures.\nSuccessful exploitation grants the attacker unauthorized access to restricted IOCTL (Input/Output Control) functionality exposed by the kernel driver.\nBecause the driver operates at kernel privilege levels (Ring 0), this vulnerability facilitates potential system compromise, arbitrary code execution in the kernel context, and total loss of system integrity.\nThe attack requires local access to the target machine and the ability to execute arbitrary code with unprivileged user permissions.",
  "technicalDetails": "The vulnerability resides within the tvk.sys kernel-mode driver, which implements a client authentication mechanism designed to restrict access to sensitive IOCTL handlers. When an application attempts to interface with the driver, tvk.sys inspects the WIN_CERTIFICATE structure associated with the calling process's binary.\nThe root cause of the vulnerability is an insufficient validation logic that substitutes proper cryptographic signature verification with simplistic substring matching. The driver parses the WIN_CERTIFICATE data provided by the caller and performs a case-sensitive check to determine if the expected publisher string 'IRONMACE Co., Ltd.' and the root certificate string 'DigiCert Trusted Root G4' are present.\nBecause the driver does not verify the authenticity of the signature through standard Windows APIs like WinVerifyTrust or cryptographically validate the PKCS #7 blob, the integrity check is purely superficial. An attacker can trivially bypass this control by appending a crafted, non-functional certificate structure to an arbitrary executable that includes the required string constants in the appropriate fields.\nThe attack flow proceeds as follows: First, the attacker develops a malicious payload intended to invoke restricted or dangerous IOCTLs provided by the tvk.sys interface. Second, the attacker prepares a dummy binary and modifies its WIN_CERTIFICATE attributes to include the hardcoded strings 'IRONMACE Co., Ltd.' and 'DigiCert Trusted Root G4'. Third, the attacker executes this binary on the target system. The driver receives the request, inspects the binary's certificate data, finds the expected substrings, and incorrectly concludes that the binary is a trusted IRONMACE component.\nOnce the driver is deceived, it initializes communication with the attacker's process, allowing the attacker to send malformed or unauthorized IOCTL packets. Given the nature of driver IOCTLs, which often directly interact with hardware or memory, this provides a pathway for an attacker to escalate privileges from a local unprivileged user to Ring 0. This post-exploitation impact includes the ability to bypass Kernel Mode Code Signing (KMCS) policies, perform arbitrary kernel-mode memory manipulation, and disable system security telemetry or EDR hooks."
}