Untrusted Pointer Dereference in ColorFul iGameCenter

A security vulnerability has been identified in ColorFul iGameCenter version 1.0.3.4, specifically affecting the IOCTL handler function sub_140001AF0 located within the ene.sys driver. This vulnerability allows an unprivileged local attacker to trigger an untrusted pointer dereference. Because the flaw resides within a kernel-mode driver, successful exploitation could lead to local privilege escalation or complete system instability. Publicly available exploit code currently exists, and the vendor has not provided a patch or response to the disclosure. Defenders should be aware that this requires local access, making it a critical concern for multi-user systems or environments where local user execution is common.

Attack Chain

1. Attacker gains low-privileged access to the target Windows system.
2. Attacker identifies the loaded ene.sys driver on the system.
3. Attacker crafts a malicious IOCTL request directed at the driver device object.
4. The malicious request reaches the vulnerable sub_140001AF0 function within ene.sys.
5. The function performs an unsafe dereference of an untrusted pointer provided in the IOCTL buffer.
6. Memory corruption occurs, allowing for arbitrary code execution in the kernel context.
7. Attacker achieves local privilege escalation to SYSTEM.

Impact

The vulnerability poses a high risk to systems running ColorFul iGameCenter, as it allows local unprivileged users to gain kernel-level access. Successful exploitation can result in complete compromise of the host OS, persistence, and bypass of standard user-mode security controls.

Recommendation

Prioritize monitoring for the existence of the vulnerable driver file on all managed workstations. If the application is not required for business operations, uninstall it immediately to remove the attack surface. Since the vendor has not addressed the issue, consider blocking the loading of the ene.sys driver via WDAC or equivalent kernel-mode code signing policies if the driver is not business-critical.