Integer Overflow Vulnerability in MSI Dragon Center NTIOLib_X64.sys

MSI Dragon Center versions up to and including 2.0.155.0 contain a critical security flaw residing within the NTIOLib_X64.sys kernel-mode driver. Specifically, the MmioWritePath function is susceptible to an integer overflow when processing manipulated input parameters for argument count or element size. Because this component runs with kernel privileges, an attacker with local access to the affected system can exploit this vulnerability to achieve privilege escalation or gain unauthorized control over the operating system. Despite early notification, the vendor has not responded to the disclosure. Proof-of-concept exploit code for this vulnerability has been made public, significantly lowering the barrier for exploitation by local threat actors.

Impact

The vulnerability carries a CVSS v3.1 base score of 8.8, reflecting the high potential for system-wide compromise. If exploited, a local attacker can bypass standard security controls to execute arbitrary code with kernel-level permissions. This poses a significant threat to systems where MSI Dragon Center is installed, particularly in multi-user environments or systems where limited-privilege users could potentially leverage the driver to escalate their access.

Recommendation

1. Identify all systems within the environment running MSI Dragon Center version 2.0.155.0 or earlier.
2. Until a patch is provided by the vendor, restrict access to the NTIOLib_X64.sys driver or uninstall MSI Dragon Center on systems where it is not business-critical.
3. Monitor endpoint security logs for unexpected execution of binaries or scripts that interact with kernel-mode drivers, specifically targeting NTIOLib_X64.sys.
4. Implement strict control over local user accounts to prevent unauthorized users from executing code that could interact with vulnerable drivers.