init

README.md

@@ -2,9 +2,9 @@
 
 ## Summary
 
-The ASUS `bsitf.sys` (also distributed as `AsusBSItf.sys`) kernel driver exposes IOCTL `0x222808` which allocates physically contiguous kernel memory of attacker-controlled size and maps it into the calling process's address space with full read/write permissions. No access control is enforced. The physical address of the allocation is returned to the caller.
+The ASUS `bsitf.sys` (also distributed as `AsusBSItf.sys`) kernel driver exposes IOCTL `0x222808` which allocates physically contiguous kernel memory of attacker-controlled size, maps it into the calling process's address space with full read/write permissions, and returns both the usermode virtual address and the physical address to the caller.
 
-Any local user can trigger this IOCTL through the `\\.\bsitf` device symlink.
+The device requires administrator privileges to open. No validation is performed on the allocation size or number of outstanding allocations.
 
 ## Affected Versions
 
@@ -18,14 +18,17 @@ All versions create device `\Device\bsitf` with symlink `\DosDevices\bsitf`.
 
 ## Impact
 
-- **Usermode R/W to kernel pool memory** — the mapped region is fully readable and writable from Ring-3
-- **Executable kernel memory** (v3.0.x) — `NonPagedPool` allocations are executable, enabling shellcode injection
-- **Physical address disclosure** — the IOCTL returns the physical address of every allocation
-- **Kernel pool exhaustion** — repeated allocations without freeing cause system BSOD
+The mapped buffer is a fresh kernel pool allocation, not an arbitrary kernel address. The caller controls its contents but not its location. This limits exploitation compared to a true arbitrary kernel R/W.
+
+- **Kernel pool exhaustion (DoS)** — repeated allocations without freeing will exhaust `NonPagedPool`, causing BSOD. No size cap or allocation limit is enforced.
+- **Physical address disclosure** — the IOCTL returns the physical address of every allocation, useful as an info leak or for DMA-based attacks.
+- **Executable kernel memory staging (v3.0.x only)** — on version 3.0.10.0, the pool type is `NonPagedPool` (executable). Shellcode can be written from usermode into the mapped buffer, but a separate vulnerability is required to redirect kernel execution to the buffer address.
+
+On v3.1.x versions (`NonPagedPoolNx`), the buffer is non-executable and the practical impact is limited to DoS and physical address disclosure.
 
 ## Root Cause
 
-IOCTL `0x222808` in the dispatch handler performs the following with no validation:
+IOCTL `0x222808` in the dispatch handler performs the following with no input validation:
 
 ```c
 alloc_size = *(DWORD *)Irp->AssociatedIrp.SystemBuffer;  // user-controlled
@@ -39,7 +42,7 @@ output[0] = user_va;        // usermode virtual address
 output[1] = physical_addr;  // physical address of allocation
 ```
 
-No checks on caller privilege, allocation size, outstanding allocation count, or device ACLs.
+No checks on allocation size, outstanding allocation count, or input validation. The device requires admin to open, but once a handle is acquired, IOCTLs are unrestricted.
 
 ## Proof of Concept
 
@@ -89,12 +92,12 @@ cargo run --release -- 10000
 [+] mapping freed successfully
 ```
 
-Tested on Windows 11 24H2.
+Tested on Windows 11 24H2 (requires administrator).
 
 ## Remediation
 
-1. Restrict device access via ACL to SYSTEM or specific service accounts
-2. Validate allocation size with a reasonable upper bound
+1. Validate allocation size with a reasonable upper bound
+2. Limit the number of outstanding allocations per handle
 3. Do not map kernel allocations into usermode address space
 4. Do not return physical addresses to usermode callers
 5. Use `NonPagedPoolNx` on all versions
@@ -105,7 +108,7 @@ Tested on Windows 11 24H2.
 |------|-------|
 | 2026-04-06 | Vulnerability discovered via automated analysis |
 | 2026-04-06 | PoC confirmed on Windows 11 24H2 |
-| 2026-04-XX | Report submitted to ASUS PSIRT |
+| 2026-04-06 | Report submitted to ASUS PSIRT |
 
 ## References