Decrement by one to rule them all: AsIO3.sys driver exploitation
Summary: Cisco Talos found two critical vulnerabilities in ASUS's AsIO3.sys driver, installed by Armoury Crate and AI Suite: a stack-based buffer overflow in the Win32-to-NT path conversion and an authorization bypass in the IRP_MJ_CREATE handler, which checks a process's image path against a hardcoded SHA256 hash for AsusCertService.exe. Talos bypassed that check with a hardlink swap and chained IOCTL primitives, including an arbitrary decrement via ObfDereferenceObject, into a working exploit that escalates a local user to NT SYSTEM.
Key Takeaway: The driver's only gate was a hash comparison against one executable, and a hardlink rename defeated it - so any local user on a machine with Armoury Crate installed had a path to SYSTEM until this was fixed.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026