GFAC Driver Privilege Escalation via Unprotected Port

Executive Summary

This vulnerability exists in the Minifilter communication port for the driver GFAC_Sys_x64.sys in Little Orbit GFAC. It allows a local attacker to access privileged driver functionality through a communication interface that does not have proper access restrictions.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves the GFAC_Sys_x64.sys driver from Little Orbit's GameFirst Anti-Cheat, which exposes a minifilter communication port lacking proper access restrictions. Detection would focus on identifying the presence of this driver and monitoring or inspecting communication through its minifilter port.

Since the vulnerability is local and related to a driver interface, network detection is not applicable. Instead, detection should be performed on the affected system by checking for the presence of the GFAC_Sys_x64.sys driver and monitoring its communication port usage.

Suggested commands to detect the presence of the vulnerable driver on a Windows system include:

• Using PowerShell to check for the driver: Get-WmiObject Win32_SystemDriver | Where-Object { $_.Name -eq 'GFAC_Sys_x64' }
• Using the command line to list loaded drivers: driverquery | findstr GFAC_Sys_x64
• Checking for the minifilter communication port might require specialized tools or scripts to enumerate minifilter ports or monitor communication, but no specific commands or tools are provided in the available resources.

Because no proof-of-concept or detection scripts are publicly available, and the vendor has not released a patch or detection tools, users are advised to restrict local access and consider disabling or removing GFAC-dependent software until a fix is available.

Useful 0 Not Useful 0

Impact Analysis

Because the vulnerability allows a local attacker to access privileged driver functionality, it could lead to unauthorized actions at the driver level, potentially compromising system security or stability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a local attacker to escalate privileges to SYSTEM level by exploiting improper access restrictions in the GFAC_Sys_x64.sys driver. This can lead to full system compromise and unauthorized access to sensitive data.

Such unauthorized access and potential data breaches could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive personal and health information.

However, the provided information does not explicitly discuss compliance impacts or specific regulatory considerations.

Useful 0 Not Useful 0

Mitigation Strategies

Since the vendor has not provided a patch, users are advised to restrict local access to trusted individuals.

It is recommended to disable or remove GFAC-dependent games until an update is available.

Useful 0 Not Useful 0