PT-2024-17493 · Msi · Msi Dragon Center+1

Topgun · Published 2024-12-05 · Updated 2024-12-05 · CVE-2024-12227

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions MSI Dragon Center versions up to 2.0.146.0

Description A problematic issue was found in the IOCTL Handler component of MSI Dragon Center, affecting the MmUnMapIoSpace function in the NTIOLib X64.sys library. This leads to a null pointer dereference. The attack can be launched on the local host, potentially allowing unauthorized local access.

Recommendations For MSI Dragon Center versions up to 2.0.146.0, upgrade to version 2.0.148.0 to address this issue. As a temporary workaround, consider restricting access to the NTIOLib X64.sys library until the upgrade is applied.

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

CVE-2024-12227

Affected Products

Msi Dragon Center

Ntiolib X64.Sys

References · 10

• https://msi.com/Landing/dragon-center-download/nb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-12227 · Security Note
• https://shareforall.notion.site/MSI-Dragon-Center-NTIOLib_X64-0xC3506104-MmMapIoSpace-DOS-15160437bb1e801daf58d4aea052970e · Note
• https://twitter.com/CVEnew/status/1864668959498539142 · Twitter Post
• https://t.me/cvedetector/12106 · Telegram Post
• https://vuldb.com/?submit.456017 · Note
• https://twitter.com/oktsec/status/1864589953428000897 · Twitter Post
• https://vuldb.com/?ctiid.286959 · Note
• https://vuldb.com/?id.286959 · Note
• https://twitter.com/VulmonFeeds/status/1864773231988658417 · Twitter Post