CVE-2024-33220: Asus AI Suite Privilege Escalation Flaw

CVE-2024-33220 Overview

CVE-2024-33220 is a driver vulnerability in the AslO3_64.sys component shipped with ASUSTeK Computer Inc. AI Suite 3 version 3.03.36. The flaw allows local attackers to escalate privileges and execute arbitrary code by sending crafted I/O control (IOCTL) requests to the vulnerable kernel driver. The issue is categorized under [CWE-782] (Exposed IOCTL with Insufficient Access Control). A public proof-of-concept has been published in a GitHub PoC Repository, increasing the risk of opportunistic abuse against systems running the affected utility.

Critical Impact
Successful exploitation grants SYSTEM-level code execution, enabling full compromise of the affected Windows host.

Affected Products

ASUSTeK Computer Inc. AI Suite 3, version 3.03.36
Kernel driver AslO3_64.sys bundled with AI Suite 3
Windows systems where AI Suite 3 has been installed and the driver is loaded

Discovery Timeline

2024-05-22 - CVE-2024-33220 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-33220

Vulnerability Analysis

The vulnerability resides in AslO3_64.sys, a signed kernel-mode driver installed by ASUS AI Suite 3. The driver exposes IOCTL handlers that perform privileged operations without adequately validating the caller or the request parameters. A local low-privileged user can open a handle to the driver device and issue crafted IOCTLs to trigger these privileged operations.

Because the driver runs in Ring 0, any primitive it exposes — such as arbitrary physical memory mapping, arbitrary MSR read/write, or arbitrary port I/O — can be converted into kernel code execution or a privilege escalation path from a standard user to NT AUTHORITY\SYSTEM. The CWE-782 classification indicates the driver exposes IOCTL functionality with insufficient access controls.

Root Cause

The root cause is insufficient access control on the IOCTL interface exposed by AslO3_64.sys. The driver accepts IOCTL requests from unprivileged callers and performs sensitive kernel operations on their behalf, without gating those requests through proper authorization checks or restricting the device object's DACL to administrators.

Attack Vector

Exploitation requires a local foothold on a Windows machine with AI Suite 3 3.03.36 installed. An attacker with standard user rights opens a handle to the driver's device object and issues the crafted IOCTL requests documented in the public proof-of-concept. Successful exploitation results in arbitrary code execution in kernel context.

No exploit code is reproduced here. See the GitHub PoC Repository for the published technical details and reference implementation.

Detection Methods for CVE-2024-33220

Indicators of Compromise

Presence of AslO3_64.sys loaded on hosts that do not require ASUS AI Suite 3 functionality
Non-administrative processes obtaining handles to the \\.\AslO3 device object
Unexpected DeviceIoControl calls from user-mode processes targeting the ASUS driver
New SYSTEM-level processes spawned from a parent that recently interacted with the driver

Detection Strategies

Inventory endpoints for the file AslO3_64.sys and correlate against the list of hosts that legitimately run AI Suite 3
Alert on service or driver load events (Windows Event ID 6, Microsoft-Windows-Kernel-PnP) referencing the vulnerable driver on hosts outside that inventory
Hunt for user-mode processes that open the driver device and immediately spawn elevated children

Monitoring Recommendations

Monitor Sysmon Event ID 1 for process creations whose parent has recently issued IOCTLs to ASUS driver device objects
Track loads of known Bring-Your-Own-Vulnerable-Driver (BYOVD) candidates including AslO3_64.sys using Microsoft's recommended driver block list
Forward driver load and privilege escalation telemetry into a SIEM for correlation with local logon activity

How to Mitigate CVE-2024-33220

Immediate Actions Required

Uninstall ASUS AI Suite 3 version 3.03.36 from systems where it is not operationally required
Remove or block the AslO3_64.sys driver file where AI Suite 3 has been uninstalled but the driver remains on disk
Enable the Microsoft Vulnerable Driver Blocklist on Windows 10, Windows 11, and Windows Server hosts
Restrict local logon rights so that only trusted administrators can execute code on affected endpoints

Patch Information

No vendor advisory or fixed version has been published in the enriched CVE data at the time of writing. Consult the ASUS support site for the latest AI Suite release and driver updates, and validate that any replacement build ships a driver version different from the one in 3.03.36.

Workarounds

Disable or unload the AslO3_64.sys driver on hosts that do not need ASUS AI Suite 3 fan, voltage, or overclocking controls
Apply Windows Defender Application Control (WDAC) policies to block loading of the vulnerable driver by hash
Enforce least privilege so standard users cannot install or interact with third-party kernel drivers

bash

# Query for the vulnerable driver on a Windows host (run in elevated PowerShell)
Get-ChildItem -Path C:\Windows\System32\drivers -Filter AslO3_64.sys -ErrorAction SilentlyContinue

# Stop and disable the driver service if present
sc.exe stop AslO3
sc.exe config AslO3 start= disabled

# Enable the Microsoft Vulnerable Driver Blocklist (Windows 11 / Server 2022+)
# Settings > Windows Security > Device security > Core isolation > Microsoft Vulnerable Driver Blocklist: On