CVE-2024-30804 Overview
CVE-2024-30804 is a driver vulnerability in the DeviceIoControl component of ASUS Fan_Xpert versions prior to v10013. The flaw allows attackers to execute arbitrary code by sending crafted Input/Output Control (IOCTL) requests to the vulnerable driver. The issue is classified under CWE-782: Exposed IOCTL with Insufficient Access Control. ASUS Fan_Xpert is a utility distributed with ASUS hardware to manage fan speeds and thermal profiles, and its kernel-mode driver exposes IOCTL interfaces to user-space callers. Because the driver does not adequately restrict or validate IOCTL handlers, an attacker reaching the device interface can leverage it to achieve code execution.
Critical Impact
A successful attack against the exposed IOCTL handler can result in arbitrary code execution with the privileges of the vulnerable kernel driver, enabling full system compromise.
Affected Products
- ASUS Fan_Xpert versions prior to v10013
- Systems with the ASUS Fan_Xpert kernel driver installed
- Windows endpoints shipping the vulnerable DeviceIoControl handler
Discovery Timeline
- 2024-04-26 - CVE-2024-30804 published to the National Vulnerability Database (NVD)
- 2026-04-15 - Last updated in the NVD database
Technical Details for CVE-2024-30804
Vulnerability Analysis
The vulnerability resides in the IOCTL dispatch logic of the ASUS Fan_Xpert driver. Windows drivers expose functionality to user mode through DeviceIoControl calls routed to IRP handlers. When a driver registers a device object accessible to low-privileged users, every IOCTL code it supports becomes an attack surface. CVE-2024-30804 exposes IOCTLs that perform privileged operations without sufficient access control or input validation, classifying the flaw under [CWE-782].
An attacker who can open a handle to the driver device sends crafted IOCTL buffers to reach the vulnerable handler. The driver then performs operations on attacker-controlled data inside kernel context, which leads to arbitrary code execution. A public proof-of-concept exists at the DriverHunter PoC Repository.
Root Cause
The root cause is insufficient validation of IOCTL inputs and missing access control on the exposed device interface. The driver trusts data supplied through DeviceIoControl and dispatches privileged operations to non-administrative callers. This pattern is common in vendor utility drivers that expose direct hardware access through generic read, write, or memory-mapping IOCTLs.
Attack Vector
The attack surface is the device object created by the ASUS Fan_Xpert driver. An attacker opens the device using CreateFile, then issues DeviceIoControl with a crafted IOCTL code and payload. The handler executes the requested operation in kernel mode, enabling arbitrary code execution. Public proof-of-concept code demonstrates the issuance of IOCTL requests against the driver; see the DriverHunter PoC Repository for technical details. No synthetic exploit code is reproduced here.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2024-30804
Indicators of Compromise
- Presence of the ASUS Fan_Xpert driver binary with a version below v10013 on Windows systems
- Unexpected non-administrative processes opening handles to the Fan_Xpert device object
- Kernel-mode crashes or bug checks correlated with DeviceIoControl calls to the Fan_Xpert driver
Detection Strategies
- Inventory installed kernel drivers and flag any ASUS Fan_Xpert driver below version v10013
- Monitor for CreateFile calls targeting the Fan_Xpert device name followed by DeviceIoControl from unsigned or untrusted processes
- Alert on driver load events for known-vulnerable hashes using Sysmon Event ID 6 and Windows Event ID 4697
Monitoring Recommendations
- Forward Sysmon driver-load, process-create, and file-handle events to a centralized log platform for correlation
- Track Windows Defender Application Control (WDAC) or Microsoft Vulnerable Driver Blocklist updates that cover this driver
- Watch for privilege escalation chains where a low-integrity process accesses the Fan_Xpert device prior to spawning elevated children
How to Mitigate CVE-2024-30804
Immediate Actions Required
- Update ASUS Fan_Xpert to version v10013 or later on all affected systems
- Uninstall ASUS Fan_Xpert from endpoints where the utility is not required for hardware management
- Enable the Microsoft Vulnerable Driver Blocklist to prevent the vulnerable driver from loading
Patch Information
ASUS addresses the issue in Fan_Xpert v10013 and later. Administrators should obtain the updated build from official ASUS support channels and confirm the on-disk driver version after installation. The DriverHunter PoC Repository documents the original behavior fixed in this release.
Workarounds
- Remove the ASUS Fan_Xpert driver where the application is not operationally required
- Restrict access to the driver device object using endpoint policy or driver blocklisting until the patched version is deployed
- Enforce Hypervisor-Protected Code Integrity (HVCI) and Memory Integrity to limit exploitation of vulnerable kernel drivers
# Verify Fan_Xpert driver version and enable the Microsoft Vulnerable Driver Blocklist
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like '*Fan_Xpert*' } | Select-Object DeviceName, DriverVersion
# Enable Microsoft Vulnerable Driver Blocklist (Windows 11 / Server 2022+)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
