Element2023H

A local attacker with low privileges can achieve local privilege escalation to gain high-impact control of the system. The issue exists within the IOCTL Handler component in the `WFanManager.sys` library, specifically affecting the `sub 11504()` function. This flaw allows for the manipulation of incorrect default permissions.

A memory corruption issue exists in the Kernel Driver component within the `shield.sys` library. A local attacker can exploit the `sub 23908()` function to corrupt kernel memory, which may result in a system crash or unauthorized control over the system.

A flaw exists in the Dispatch Handler component within the `AMDRyzenMasterDriver.sys` library. A local attacker can manipulate the `SystemBuffer` argument in the `MmMapIoSpace()` function to perform unsafe actions and elevate privileges.

A flaw exists in the `sub 14000885C` function within the `kgameprotect.sys` library. A local attacker can manipulate the `Pid` argument to cause improper privilege management.

A flaw exists in the IOCTL Process Termination component within the LWBilling64.sys library. Specifically, the `sub 14000443C()` function is susceptible to manipulation of the `Pid` argument, which can lead to an exposed IOCTL (Input/Output Control) with insufficient access control. This issue requires local access to be exploited.

Improper privilege management exists within the IOCTL Handler component of the `mtdispkm64.sys` library. Specifically, the `sub 140006F0C()` function can be manipulated by a local attacker to gain unauthorized privileges.

A local issue exists within the IRP MJ DEVICE CONTROL Handler component in the `shdrv x64.sys` file. Specifically, the `sub 180004AC0()` function does not properly handle the `PID` argument, which can be manipulated to cause a denial of service.

A heap-based buffer overflow exists in the IOCTL Handler component within the `mtdispkm64.sys` library. The issue occurs in the `sub 140001000()` function and requires local access to be exploited.

Improper privilege management exists within the IOCTL Dispatch component of the `WinRing0x64.sys` library. A local attacker can exploit this by manipulating the `PhysicalAddress`, `AlignNumer`, and `AlignSize` arguments passed to the `sub 11504()` function.

A flaw in the IOCTL Handler component affects the `IRP MJ DEVICE CONTROL` function within the `IUForceDelete.sys` library. Local access is required to perform a manipulation that can lead to improper privilege management.

Improper privilege management occurs within the IRP MJ DEVICE CONTROL Handler component of the `IObitUnlocker.sys` library. Specifically, the issue resides in the `ZwTerminateProcess()` function. This flaw requires local access to be exploited.