bs_rcio.sys

bs_rcio.sys is the kernel driver bundled with BIOSTAR's RACING GT Evo utility for Racing-series motherboards. It is a sibling to bs_hwmio64_w10.sysDriverbs_hwmio64_w10.sysBIOSTAR hardware I/O driverOpen plate → and bs_i2cio.sysDriverbs_i2cio.sysBIOSTAR I2C interface driverOpen plate → (the BIOSTAR family already on the public LOLDrivers list), and it exists to give the tuning app a direct line into hardware for monitoring and overclocking.

CVE-2021-44852 documents that the driver shipped without proper access controls on its device object, so any local process (even an unprivileged one) could talk to it and use its kernel-level capabilities. Because it is WHQL-signed by BIOSTAR, it loads cleanly even on systems with strict signature enforcement, which is what makes it useful as a BYOVD stepping stone for criminal threat actors.

If you do not own a BIOSTAR Racing-series board, you should never see this file. If you do, update the RACING GT Evo utility; Microsoft's Vulnerable Driver Blocklist will keep the older signed build from loading.

bs_rcio.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.