ASUS DriverHub Update TOCTOU Local Privilege Escalation — CVE-2026-1880

Metadata

Affected Target

Summary

ASUS DriverHub updates drivers by downloading a package, extracting it to C:\ProgramData\ASUS\AsusDriverHub\SupportTemp\<driver_name>, and later launching setup.exe from that directory via ShellExecuteExW. Because the driver folder name can be predicted from model.xml and the extraction step skips folders that already exist, a low-privileged local user can pre-create the expected folder with an attacker-controlled setup.exe before the legitimate update runs. By placing an oplock on setup.ini to control the timing window, the attacker can swap in a malicious payload between the check and the execution of the installer, causing DriverHub to launch attacker-controlled code with the elevated privileges it runs under. The included PoC (ASUS_HUB_TOCTOU) automates directory pre-creation and race-window handling, while setup_payload is a stand-in payload binary that demonstrates code execution and privilege confirmation once launched.

Vulnerability Details

Root Cause

DriverHub’s update routine resolves and launches setup.exe from a fixed, predictable path under SupportTemp without re-validating file ownership, integrity, or existence immediately before execution, and its DLL (ToolsPageDLL.dll, function selectInstall) calls ShellExecuteExW purely based on path resolution — a classic time-of-check-to-time-of-use (TOCTOU) gap.

Attack Vector

1. Predict the target driver’s folder name in advance from model.xml.
2. Pre-create C:\ProgramData\ASUS\AsusDriverHub\SupportTemp\<driver_name>\setup.exe with attacker-controlled content before an update is triggered.
3. Wait for/trigger the DriverHub update process; the ZIP extraction step skips the already-existing folder, leaving the planted file in place.
4. Place an oplock on setup.ini to detect and control the timing of the update process reaching the execution step.
5. During the race window, swap the planted file for the final malicious payload.
6. DriverHub invokes ShellExecuteExW on the path, executing the attacker’s payload with the elevated privileges DriverHub runs under.

Impact

A low-privileged local user can escalate to administrator/SYSTEM-level code execution, resulting in full local privilege escalation and potential complete host compromise.

Environment / Lab Setup

Target:   Windows host with ASUS DriverHub installed (vulnerable update flow)
Attacker: Local low-privileged Windows account; Visual Studio toolchain to build ASUS_HUB_TOCTOU and setup_payload

Proof of Concept

PoC Script

See ASUS_HUB_TOCTOU/main.cpp (with Win-Ops-Master.cpp/.h and NtDefine.h) and setup_payload/payload.cpp in this folder. Full technical write-up available in ASUS_HUB_TOCTOU.pdf.

1

ASUS_HUB_TOCTOU.exe

ASUS_HUB_TOCTOU reads DriverHub’s model.xml to predict driver folder names, pre-creates the target directory/setup.exe, and manages the oplock-based race window; setup_payload builds into the substituted setup.exe that demonstrates privilege confirmation (e.g. printing the executing user) once launched by DriverHub.

Detection & Indicators of Compromise

Signs of compromise:

• Non-ASUS-signed setup.exe binaries appearing under SupportTemp\<driver_name>\.
• Oplock/file-lock activity on setup.ini from a non-DriverHub process.
• Unexpected elevated processes spawned by ADU.exe/ToolsPageDLL.dll shortly after a driver update.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/seokjohn/CVE-2026-1880 on 2026-07-05.