← Back to driver explorer
Driver intelligenceVulnerableVerified
MsIo64.sys
The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054)
Known samples 1
0 recorded TRUE · 1 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
MsIo64.sysSample 1 · HVCI FALSE
- MD5
dc943bf367ae77016ae399df8e71d38a- SHA1
6b54f8f137778c1391285fee6150dfa58a8120b1- SHA256
43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89- Imphash
8a424cd36ae3eab0d11332ce3b982a02- Authentihash MD5
9bb721ac0afc94a499a238ae32418d51- Authentihash SHA1
04a903f13528536f1d0b1751886754d9aa5cdafa- Authentihash SHA256
5bf00eff58e5bbe4cf578ec37b9e13c8fa74511fb2644352fcc091347153a709- Machine
- AMD64
- Version
- 1.1 x64 built by: WinDDK
- Publisher
- MICSYS Technology Co., LTd
Recorded command
sc.exe create MsIo64.sys binPath=C:\windows\temp\MsIo64.sys type=kernel && sc.exe start MsIo64.sysElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://www.matteomalvica.com/blog/2020/09/24/weaponizing-cve-2020-17382/
- https://packetstormsecurity.com/files/159315/MSI-Ambient-Link-Driver-1.0.0.8-Privilege-Escalation.html
- https://www.coresecurity.com/core-labs/advisories/msi-ambient-link-multiple-vulnerabilities
- https://github.com/Exploitables/CVE-2020-17382
- https://github.com/namazso/physmem_drivers