Lenovo Dispatcher PoC

This is a basic proof of concept to exploit lenovo dispatcher driver (LnvMSRIO.sys) (CVE-2025-8061). Vulnerabilities found by Luis Casvella (source: https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html).

The main idea of this poc is to exploit the read/write primitives only, to steal the system token from ntoskrnl.exe. To do this the poc uses Superfetch/PFN (https://www.outflank.nl/blog/2023/12/14/mapping-virtual-to-physical-adresses-using-superfetch/) to be able to translate virtual addreses to physical addresses in usermode.

By using superfetch, we can translate virtual to physical addresses to directly provide them to the vulnerable driver, which allows us to read and write any address we want. With that, the poc will just overwrite the start of the NtAddAtom function defined in ntoskrnl.exe with a little shellcode to jump to usermode shellcode, defined in our rust code (steal_kernel_token_shellcode_fn in base.rs) using inline assembly. This little shellcode is genrated in generate_jmp_user_shellcode, and as we can see, it will unset the 20 bit in CR4 to disable SMEP, to then call our userland shellcode (to steal system token) and finally re-enable SMEP.

With all this, we will get our system cmd.

IMPORTANT: running as admin is requeried to query superfetch.

It has been tested on Windows 10 (22h2) and Windows 11 (25h2). Adjust the offsets as required for your Windows version.