PT-2024-17709 · Velocidex · Velocidex Winpmem

Published 2024-12-16 · Updated 2024-12-21 · CVE-2024-12668

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Velocidex WinPmem versions below 4.1

Description The issue allows a user space program to trick the driver into writing a 0 into any chosen memory location by using an IO Control. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the g CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system, allowing attackers to load unsigned drivers.

Recommendations For Velocidex WinPmem versions below 4.1, update to version 4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable driver to minimize the risk of exploitation. Avoid using the vulnerable IO Control until the issue is resolved. At the moment, there is no other information about additional mitigation measures.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-12668

Affected Products

Velocidex Winpmem

References · 6

• https://osv.dev/vulnerability/CVE-2024-12668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12668 · Security Note
• https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1 · Note
• https://twitter.com/CVEnew/status/1868676414095954304 · Twitter Post
• https://twitter.com/cracbot/status/1870348543686492459 · Twitter Post
• https://t.me/cvenotify/104408 · Telegram Post