ASUS bsitf.sys BIOS Flash Driver Unvalidated Kernel Memory Allocation and Physical Address Disclosure

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-13585.ps1
  Detects whether the host is vulnerable to CVE-2026-13585
  (ASUS bsitf.sys arbitrary physical memory mapping)
  Output: VULNERABLE / PATCHED / UNKNOWN
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'SilentlyContinue'
$vulnerable = $false
$found = $false

# Known driver file locations
$driverPaths = @(
    "$env:SystemRoot\System32\drivers\bsitf.sys",
    "$env:SystemRoot\System32\drivers\AsusBSItf.sys"
)

# Check for driver files
foreach ($path in $driverPaths) {
    if (Test-Path $path) {
        $found = $true
        $fileVersion = (Get-Item $path).VersionInfo.FileVersionRaw
        Write-Host "[*] Found driver: $path"
        Write-Host "[*] Driver version: $fileVersion"

        # Vulnerable versions: 3.0.10.0, 3.1.10.0, 3.1.25.0, and anything below 3.1.66.0
        # for SCI v3, or below 1.1.40.0 for SCI v1
        $major = $fileVersion.Major
        $minor = $fileVersion.Minor
        $build = $fileVersion.Build

        if ($major -eq 3 -and $minor -le 1 -and $build -lt 66) {
            $vulnerable = $true
            Write-Host "[!] Driver version $fileVersion is BELOW fixed version 3.1.66.0"
        } elseif ($major -eq 1 -and ($minor -lt 1 -or ($minor -eq 1 -and $build -lt 40))) {
            $vulnerable = $true
            Write-Host "[!] Driver version $fileVersion is BELOW fixed version 1.1.40.0"
        } elseif ($major -lt 1) {
            $vulnerable = $true
            Write-Host "[!] Driver version $fileVersion is BELOW all known fixed versions"
        } else {
            Write-Host "[+] Driver version $fileVersion appears patched"
        }
    }
}

# Check for ASUS software in registry
$regPaths = @(
    'HKLM:\SOFTWARE\ASUS\ASUS System Control Interface',
    'HKLM:\SOFTWARE\ASUS\ASUS Business Manager',
    'HKLM:\SOFTWARE\WOW6432Node\ASUS\ASUS System Control Interface',
    'HKLM:\SOFTWARE\WOW6432Node\ASUS\ASUS Business Manager'
)

foreach ($regPath in $regPaths) {
    $reg = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue
    if ($reg) {
        $found = $true
        $ver = $reg.Version
        if (-not $ver) { $ver = $reg.DisplayVersion }
        Write-Host "[*] Registry key found: $regPath (Version: $ver)"
    }
}

# Check if driver is currently loaded
$loadedDriver = Get-WmiObject Win32_SystemDriver | Where-Object { $_.Name -match 'bsitf' -or $_.DisplayName -match 'bsitf' -or $_.DisplayName -match 'AsusBSItf' }
if ($loadedDriver) {
    $found = $true
    Write-Host "[*] Driver service is registered: $($loadedDriver.Name) — State: $($loadedDriver.State)"
}

# Check WDAC/HVCI status as compensating control
$hvci = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace 'root\Microsoft\Windows\DeviceGuard' -ErrorAction SilentlyContinue
if ($hvci -and $hvci.VirtualizationBasedSecurityStatus -eq 2) {
    Write-Host "[+] HVCI is ENABLED — BYOVD risk is reduced (12/14 known hashes blocked)"
} else {
    Write-Host "[-] HVCI is NOT enabled — BYOVD side-loading of bsitf.sys is possible"
}

# Verdict
Write-Host ''
if (-not $found) {
    Write-Host 'UNKNOWN — No ASUS bsitf.sys driver or related software detected on this host.'
    exit 2
} elseif ($vulnerable) {
    Write-Host 'VULNERABLE — Vulnerable version of bsitf.sys detected. Update ASUS System Control Interface immediately.'
    exit 1
} else {
    Write-Host 'PATCHED — ASUS driver/software present but at or above fixed version.'
    exit 0
}