A critical write-what-where vulnerability in BioStar VALKYRIE AURORA enables local attackers to escalate privileges through kernel memory corruption.

This vulnerability affects the BS_RVSIO64.sys kernel-mode driver, specifically the sub_1105C function within the IOCTL handler. A local attacker can manipulate the PhysicalAddress parameter to execute arbitrary memory writes, leading to privilege escalation.

The CVSS score of 8.8 indicates a high-impact vulnerability that could compromise the entire operating system. An attacker could use this flaw to bypass kernel-mode security protections, leading to total system control and persistent unauthorized access to organizational assets.

Immediate Action: Since no patch is currently available, organizations should restrict local user access to systems where VALKYRIE AURORA is installed.

Proactive Monitoring: Review system logs for unauthorized attempts to communicate with the BS_RVSIO64.sys kernel driver.

Compensating Controls: Utilize host-based intrusion prevention systems (HIPS) or EDR tools to block unauthorized IOCTL calls to sensitive kernel drivers.

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the vulnerability disclosure.

The presence of a public exploit for this kernel-level flaw necessitates immediate attention. Security teams must monitor for potential exploitation and restrict local access to the affected software until a vendor-provided patch is available.