ASUS bsitf.sys (CVE-2026-13585): Arbitrary Physical Memory Mapping in ASUS Business/Software Manager kernel driver

[Hayaturehman Ahmadzai <hayaturehmanahmadzai () gmail com>]

Hi all,

I'm disclosing a vulnerability (CVE-2026-13585) in the ASUS bsitf.sys /
AsusBSItf.sys kernel driver, shipped with ASUS Business Manager and
Software Manager. ASUS has assigned the CVE and published a vendor advisory
with countermeasures.

Summary: The driver exposes a device (\\.\bsitf, admin-required to open)
with an IOCTL that allocates a caller-specified amount of physically
contiguous kernel memory, maps it into the calling process, and returns
both the user-space pointer and the physical address, with no validation on
the requested size, no cap on allocation count, and no input checking.

Observed impact:

- Pool-exhaustion denial of service: uncapped allocations in a loop exhaust
NonPagedPool and BSOD the machine, reachable from any admin process.
- Physical address disclosure on every allocation, useful as an info-leak
primitive or for DMA-oriented attacks.
- On version 3.0.10.0 the pool type is executable (NonPagedPool), enabling
shellcode staging at a known kernel address (still requires a separate
control-flow bug). Later 3.1.x versions use NonPagedPoolNx, so this does
not apply there.

Affected versions tested: 3.0.10.0 (bsitf.sys), 3.1.10.0 and 3.1.25.0
(AsusBSItf.sys). All exhibit the same flaw.

Timeline:
- 2026-04-06: Discovered, PoC confirmed on Windows 11 24H2, reported to
ASUS PSIRT
- 2026-07-14: CVE assigned and case closed (CVE-2026-13585)
- 2026-07-15: Vendor advisory and countermeasures released

Full technical writeup and PoC: https://blog.ahmadz.ai/asus_bsitf_0_day_poc/

Regards,

Rehman Ahmadzai
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/