CVE-2024-30804

Executive Summary

CVE-2024-30804 is a critical vulnerability discovered in the DeviceIoControl component of ASUS Fan_Xpert software, versions prior to v10013. The flaw allows an attacker to execute arbitrary code by sending crafted IOCTL requests. This vulnerability is classified as a local privilege escalation (LPE) or arbitrary code execution (ACE) issue, depending on the attacker’s access level. The CVSS score is currently unassigned (0.0), but based on the nature of the vulnerability, it is likely high severity. No public proof-of-concept (PoC) or exploit code has been released, and no patch details are available from ASUS at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for affected systems.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Local (L) – requires local access to the system
• Attack Complexity: Low (L) – crafted IOCTL requests are straightforward
• Privileges Required: Low (L) – attacker may need user-level access
• User Interaction: None (N) – no user action required
• Scope: Unchanged (U) – vulnerability does not affect other components
• Confidentiality Impact: High (H) – arbitrary code execution can lead to data theft
• Integrity Impact: High (H) – code execution can modify system files
• Availability Impact: High (H) – code execution can crash the system
• Threat Level: Critical – due to potential for full system compromise

Deep Dive & Mechanics

The vulnerability resides in the DeviceIoControl function of ASUS Fan_Xpert, a utility for managing fan speeds on ASUS motherboards. DeviceIoControl is a Windows API used for sending control codes to device drivers. The flaw occurs when the software processes specially crafted IOCTL requests without proper validation, leading to a buffer overflow or memory corruption. This allows an attacker to overwrite critical memory structures and execute arbitrary code in the context of the vulnerable process, which typically runs with elevated privileges.

The attack vector is local, meaning an attacker must have access to the target system (e.g., via malware, physical access, or a compromised user account). The vulnerability does not require user interaction, making it suitable for automated exploitation. The lack of a patch from ASUS increases the risk, as systems remain exposed until a fix is released.

Vulnerable vs. Patched Code

No patched version is available for comparison. The vulnerable code is in the DeviceIoControl handler within Fan_Xpert versions prior to v10013. The issue likely involves insufficient bounds checking on input buffers or improper handling of IOCTL codes. A patched version would include input validation, size checks, and safe memory copy functions.

Exploitation & Lab Setup

Red Team

To exploit CVE-2024-30804, an attacker would need to:

1. Gain local access to a system running ASUS Fan_Xpert (version < v10013).
2. Identify the vulnerable IOCTL code and craft a malicious request.
3. Use a tool like DeviceIoControl in C/C++ or Python with ctypes to send the crafted request.
4. Trigger a buffer overflow to execute shellcode.

Example exploit skeleton (conceptual, not functional):

#include <windows.h>
#include <stdio.h>

int main() {
    HANDLE hDevice = CreateFile("\\\\.\\Fan_Xpert", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open device\n");
        return 1;
    }

    DWORD bytesReturned;
    char inputBuffer[0x1000];
    // Fill with crafted data to trigger overflow
    memset(inputBuffer, 'A', sizeof(inputBuffer));

    // Send IOCTL code (example: 0x222000)
    DeviceIoControl(hDevice, 0x222000, inputBuffer, sizeof(inputBuffer), NULL, 0, &bytesReturned, NULL);

    CloseHandle(hDevice);
    return 0;
}

Blue Team

To detect exploitation attempts:

• Monitor for unusual DeviceIoControl calls to the Fan_Xpert driver.
• Use Sysmon to log process creation and driver interactions.
• Enable Windows Event Logging for kernel-level events.
• Deploy EDR solutions to detect buffer overflow patterns.

Indicators of Compromise (IOCs)

• File Hashes: Unknown (no samples available)
• Process Names: Fan_Xpert.exe or related processes
• Registry Keys: HKLM\SYSTEM\CurrentControlSet\Services\Fan_Xpert
• Network Indicators: None (local vulnerability)
• Behavioral: Unusual IOCTL requests to \\.\Fan_Xpert device

Detection Engineering

YARA Rule

rule CVE_2024_30804_ASUS_Fan_Xpert {
    meta:
        description = "Detects exploitation attempts of CVE-2024-30804 via crafted IOCTL requests"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-30804"
    strings:
        $ioctl = "DeviceIoControl" ascii wide nocase
        $fan = "Fan_Xpert" ascii wide nocase
        $overflow = { 41 41 41 41 } // Pattern of 'AAAA' in buffer
    condition:
        $ioctl and $fan and #overflow > 10
}

Sigma Rule

title: CVE-2024-30804 ASUS Fan_Xpert IOCTL Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-30804 via DeviceIoControl calls
author: Valters IT
date: 2025-04-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\Fan_Xpert.exe'
        CommandLine|contains: 'DeviceIoControl'
    condition: selection
falsepositives:
    - Legitimate use of Fan_Xpert utility
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-30804 ASUS Fan_Xpert IOCTL Exploitation Attempt"; content:"DeviceIoControl"; content:"Fan_Xpert"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or uninstall ASUS Fan_Xpert until a patch is released.
• Workaround: Restrict local access to the system and use least privilege principles.
• Patch: Monitor ASUS support page for updates (v10013 or later).
• Detection: Deploy the provided YARA, Sigma, and Suricata rules.
• Long-term: Implement application whitelisting and driver signing enforcement.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert