PoC Exploit Unveiled for Lenovo Code Execution Vulnerability Enabling Privilege Escalation
A critical vulnerability identified in Lenovo's Dispatcher drivers has been highlighted following the release of a proof-of-concept (PoC) exploit that illustrates privilege escalation on affected Windows systems.
A critical vulnerability identified in Lenovo's Dispatcher drivers has been highlighted following the release of a proof-of-concept (PoC) exploit that illustrates privilege escalation on affected Windows systems.
Designated as CVE-2025-8061, the vulnerability arises from insufficient access controls in the drivers, potentially enabling local attackers to execute arbitrary code with elevated privileges.
Security firm Quarkslab discovered the issue, which affects Lenovo consumer notebooks operating with older driver versions, posing a risk for users who have not yet implemented the latest patches.
The Lenovo Dispatcher drivers, versions 3.0 and 3.1, are responsible for managing system processes on certain consumer notebooks. These drivers expose an IOCTL interface without adequate access restrictions.
This flaw, categorized under CWE-782, allows an authenticated local user to manipulate the driver and initiate code execution in kernel mode, potentially leading to full system compromise.
The National Vulnerability Database has assigned this issue a CVSS 4.0 score of 7.3, indicating significant impacts on confidentiality, integrity, and availability, although it necessitates local access and has a high attack complexity.
Systems affected include those with the LnvMSRIO.sys driver up to version 3.1.0.36, typically found in Lenovo laptops with Windows 10 or older Windows 11 builds lacking default mitigations.
Versions Lenovo Dispatcher 3.2 and above are not affected, as Lenovo addressed the vulnerability in version 3.1.0.41, released in September 2025.
Notably, enabling Windows Core Isolation Memory Integrity prevents exploitation. This feature is active by default on Windows 11 Lenovo systems, mitigating real-world risk for updated users.
Aspect Details
The Lenovo Dispatcher drivers, versions 3.0 and 3.1, are responsible for managing system processes on certain consumer notebooks.
Affected Products Lenovo Dispatcher Driver 3.0, 3.1 (LnvMSRIO.sys up to 3.1.0.36) on consumer notebooks
Impact Assessment Local privilege escalation to kernel mode, potential full system control
Exploit Prerequisites Authenticated local user access; Core Isolation disabled; specific Windows build (e.g., 24H2 without HVCI)
CVSS 3.1 Score N/A (CVSS 4.0: 7.3 – High)
Security researcher Luis Casvella from Quarkslab detailed the exploit, demonstrating how attackers could leverage the driver's MSR read primitive to leak kernel addresses like KiSystemCall64 via the LSTAR register (MSR 0xC0000082).
This allows the bypassing of ASLR and SMEP protections, with the PoC showcasing shellcode for token theft to impersonate the SYSTEM process.
A GitHub repository by symeonp provides a working PoC capable of spawning a SYSTEM shell on Windows 11 24H2 , hardcoded for build 26100.1, requiring adjustments for offsets like KiSystemCall64 at 0x6b2b40 and CR4 manipulation to disable SMEP (bit 20).
The technique includes reading MSRs to locate syscalls, injecting shellcode that navigates kernel structures such as _KPCR and _EPROCESS for token manipulation, and restoring registers like CR4 and LSTAR to prevent system crashes.
Casvella's analysis notes four related bugs in the driver, emphasizing BYOVD tactics where signed drivers bypass DSE for post-exploitation.
While no wild exploits have been reported, the public PoC highlights the ease of adaptation for red teamers or malware authors targeting unpatched Lenovo devices.
Lenovo advises immediate updates to Dispatcher Driver 3.1.0.41 or later via Windows Update or their support site to mitigate the risk.
For additional protection, users should ensure Core Isolation is enabled in Windows Security under Device Security, turning on Memory Integrity if it is not active, to block kernel exploits without performance impacts on modern hardware.
Organizations are encouraged to scan for vulnerable drivers using tools from providers like AhnLab or monitor for IOCTL anomalies on endpoints.
The disclosure timeline indicates Quarkslab's coordinated efforts with Lenovo since June 2025, leading to patches despite delays.
As BYOVD remains prevalent in advanced threats, this incident underscores the importance of effective driver management in enterprise environments. With the PoC now available, prompt action is crucial to protect against privilege escalation chains in real-world attacks.
Based on reporting by Cyber Security News.