CVE-2021-47786
📋 TL;DR
This vulnerability in Redragon Gaming Mouse drivers allows attackers to cause a kernel-level denial of service by sending specially crafted IOCTL requests. Attackers can crash the driver with a 2000-byte buffer containing specific byte patterns, potentially causing system instability or crashes. Users of affected Redragon gaming mice with the vulnerable driver installed are at risk.
💻 Affected Systems
- Redragon Gaming Mouse devices with vulnerable driver
📦 What is this software?
M721 Firmware by Redragon
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or blue screen requiring reboot, potentially leading to data loss or system instability.
Likely Case
Local denial of service affecting mouse functionality and potentially causing system instability until reboot.
If Mitigated
Minimal impact with proper access controls preventing unauthorized users from sending IOCTL requests.
🎯 Exploit Status
Exploit requires local access to send IOCTL requests. Public proof-of-concept code is available on Exploit-DB and GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.redragonzone.com/
Restart Required: Yes
Instructions:
1. Check Redragon website for driver updates
2. Download and install latest driver
3. Restart system
4. Verify driver version is updated
🔧 Temporary Workarounds
Restrict driver access
windowsModify permissions to prevent unauthorized users from accessing the REDRAGON_MOUSE device
Uninstall vulnerable driver
windowsRemove the Redragon mouse driver and use generic HID drivers instead
Control Panel > Device Manager > Mice and other pointing devices > Right-click Redragon device > Uninstall device
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from sending IOCTL requests
- Monitor for unusual driver crashes or system instability events
🔍 How to Verify
Check if Vulnerable:
Check if REDRAGON_MOUSE device exists in Device Manager and driver version is outdatedCheck Version:
Driver version can be checked in Device Manager > Properties > Driver tabVerify Fix Applied:
Verify latest driver version from Redragon website is installed and device functions normally📡 Detection & Monitoring
Log Indicators:
- System crashes (Event ID 41)
- Driver failure events
- Unexpected system reboots
Network Indicators:
- Local IOCTL requests to REDRAGON_MOUSE device
SIEM Query:
EventID=41 OR (Source="System" AND EventID=7031) AND Description contains "REDRAGON"