KovaPlusFltr.sys: an unprivileged kernel stack overflow in the ROCCAT Kova[+] HID filter driver
— glaurung surfaced an unbounded ioctl copy in a 2010 ROCCAT gaming-mouse filter driver: an attacker-controlled length copied into a fixed 3000-byte kernel stack buffer with no upper bound and no /GS cookie, overwriting the saved return address. unprivileged with a controlled kernel write, but reachable only when the Kova[+] mouse is present, which we reproduced in qemu by emulating the hardware the driver expects.