Privilege Escalation in Ultra RAMDisk Pro Kernel Driver

Executive Summary

This vulnerability is in ieungSoft Ultra RAMDisk Pro 1.82, specifically in the URDSCSI.sys kernel driver. It allows improper privilege management due to missing authorization checks in the driver, enabling local users to write arbitrary registry values under protected hives like HKLM. This can lead to local privilege escalation by modifying critical system configurations.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the vulnerable driver URDSCSI.sys in the system's drivers directory. Look for unusual registry writes under protected hives like HKLM by monitoring registry changes or using tools like Process Monitor to detect unauthorized writes via the exposed control device \\.\UltraRAMDiskIOCTL.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could exploit this to escalate privileges on your system. They could modify registry keys to alter service configurations, COM server registrations, or autorun entries, potentially gaining elevated system access. This could allow them to install malware, steal data, or take full control of the affected machine.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the control device \\.\UltraRAMDiskIOCTL. Update or remove Ultra RAMDisk Pro 1.82. Implement proper authorization checks in the driver to prevent unauthorized registry writes. Consider using endpoint protection tools to block attempts to exploit this vulnerability.

Useful 0 Not Useful 0