Attack Chain

1. Attacker creates an NTFS hardlink to a directory or file path containing the substring "AsusCertService".
2. Attacker launches a controlled process (the exploit) through the created hardlink to bypass the driver's path validation check.
3. Attacker re-points the hardlink to the legitimate AsusCertService.exe to satisfy the driver's authentication requirements.
4. The malicious process opens a handle to the \\.\AsIO3 device.
5. The attacker invokes IOCTL 0xA0402450, triggering the vulnerable ObfDereferenceObject function to decrement memory at a chosen address.
6. The exploit targets the KTHREAD+0x232 field to set PreviousMode to 0, enabling kernel-mode access for the user-mode process.
7. Attacker performs token stealing by locating the SYSTEM EPROCESS structure and updating their own process token.
8. Attacker restores the PreviousMode to 1 to avoid system instability (BSOD) and executes a payload with SYSTEM privileges.

Impact

Successful exploitation results in full local privilege escalation to the NT AUTHORITY\SYSTEM account. This allows an attacker who has already gained a low-privileged foothold on a Windows machine to gain total control over the operating system, bypass security controls, and persist with the highest level of system privileges. The scope is limited to systems where the vulnerable ASUS driver is installed and specifically on Windows 11 22H2 or older builds that lack modern protections against PreviousMode manipulation.

Recommendation

• Identify and audit systems with the ASUS AsIO3.sys driver installed, particularly those running Windows 11 22H2 or older.
• Uninstall or update ASUS software (Armoury Crate, AI Suite) to versions that incorporate a patched version of the driver.
• Deploy endpoint security policies to restrict the loading of vulnerable third-party drivers using Windows Defender Application Control (WDAC).
• Monitor for processes attempting to access \\.\AsIO3 or making unexpected IOCTL calls to the driver.