CVE-2024-12668 (GCVE-0-2024-12668)

Vulnerability from cvelistv5 – Published: 2024-12-16 14:56 – Updated: 2024-12-16 16:14
VLAI
Title
Velocidex WinPmem Out of Bounds Write Vulnerability
Summary
Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers.
Severity
8.2 (High)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-16 15:23 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Velocidex WinPmem Affected: <= 4.1 (semver)
guessed Create a notification for this product.
Date Public
2024-12-16 14:50
Credits
We thank David Baptiste from the ERNW Vulnerability Disclosure Team for responsibly disclosing this issue.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-12668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-16T15:23:38.029993Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-16T15:25:57.658Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WinPmem",
          "vendor": "Velocidex",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "We thank David Baptiste from the ERNW Vulnerability Disclosure Team for responsibly disclosing this issue."
        }
      ],
      "datePublic": "2024-12-16T14:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability.\u0026nbsp;By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the  g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers.\u0026nbsp;\u0026nbsp;\u0026nbsp;\u003cbr\u003e"
            }
          ],
          "value": "Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability.\u00a0By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the  g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-16T16:14:22.987Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "url": "https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Velocidex WinPmem Out of Bounds Write Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2024-12668",
    "datePublished": "2024-12-16T14:56:17.136Z",
    "dateReserved": "2024-12-16T10:01:23.823Z",
    "dateUpdated": "2024-12-16T16:14:22.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-12668",
      "date": "2026-10-04",
      "epss": "0.00211",
      "percentile": "0.10337"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability.\u00a0By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the  g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers."
        },
        {
          "lang": "es",
          "value": "Las versiones de Velocidex WinPmem anteriores a la 4.1 sufren una vulnerabilidad de escritura fuera de los l\u00edmites. Al usar un control de E/S, un programa de espacio de usuario puede enga\u00f1ar al controlador para que escriba un 0 en cualquier ubicaci\u00f3n de memoria elegida. Junto con la fuga de informaci\u00f3n del controlador WinPmem, los atacantes pueden descubrir la ubicaci\u00f3n en la memoria del s\u00edmbolo global g_CiOptions. Esto se puede aprovechar para desactivar la aplicaci\u00f3n de controladores firmados en el sistema de destino, lo que permite a los atacantes cargar controladores no firmados."
        }
      ],
      "id": "CVE-2024-12668",
      "lastModified": "2024-12-16T17:15:09.700",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.5,
            "impactScore": 6.0,
            "source": "cve@rapid7.com",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-12-16T15:15:06.807",
      "references": [
        {
          "source": "cve@rapid7.com",
          "url": "https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1"
        }
      ],
      "sourceIdentifier": "cve@rapid7.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-787"
            }
          ],
          "source": "cve@rapid7.com",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "WinPmem",
                "vendor": "Velocidex",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c= 4.1",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "cve@rapid7.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability.\u00a0By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the  g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers."
          },
          {
            "lang": "es",
            "value": "Las versiones de Velocidex WinPmem anteriores a la 4.1 sufren una vulnerabilidad de escritura fuera de los l\u00edmites. Al usar un control de E/S, un programa de espacio de usuario puede enga\u00f1ar al controlador para que escriba un 0 en cualquier ubicaci\u00f3n de memoria elegida. Junto con la fuga de informaci\u00f3n del controlador WinPmem, los atacantes pueden descubrir la ubicaci\u00f3n en la memoria del s\u00edmbolo global g_CiOptions. Esto se puede aprovechar para desactivar la aplicaci\u00f3n de controladores firmados en el sistema de destino, lo que permite a los atacantes cargar controladores no firmados."
          }
        ],
        "id": "CVE-2024-12668",
        "lastModified": "2026-06-17T07:00:15.173",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.5,
              "impactScore": 6.0,
              "source": "cve@rapid7.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-12668",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-16T15:23:38.029993Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-12-16T15:15:06.807",
        "references": [
          {
            "source": "cve@rapid7.com",
            "url": "https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1"
          }
        ],
        "sourceIdentifier": "cve@rapid7.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "cve@rapid7.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T22:16:20+00:00",
      "cve": "CVE-2024-12668",
      "id": "CVE-2024-12668",
      "initial_release_date": "2024-12-16T14:50:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Velocidex WinPmem Out of Bounds Write Vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-12668.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-12668",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-12-16T15:23:38.029993Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-12-16T15:23:50.163Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "WinPmem",
              "vendor": "Velocidex",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c= 4.1",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "reporter",
              "value": "We thank David Baptiste from the ERNW Vulnerability Disclosure Team for responsibly disclosing this issue."
            }
          ],
          "datePublic": "2024-12-16T14:50:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability.\u0026nbsp;By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the  g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers.\u0026nbsp;\u0026nbsp;\u0026nbsp;\u003cbr\u003e"
                }
              ],
              "value": "Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability.\u00a0By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the  g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "CWE-787 Out-of-bounds Write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-12-16T16:14:22.987Z",
            "orgId": "9974b330-7714-4307-a722-5648477acda7",
            "shortName": "rapid7"
          },
          "references": [
            {
              "url": "https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Velocidex WinPmem Out of Bounds Write Vulnerability",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
        "assignerShortName": "rapid7",
        "cveId": "CVE-2024-12668",
        "datePublished": "2024-12-16T14:56:17.136Z",
        "dateReserved": "2024-12-16T10:01:23.823Z",
        "dateUpdated": "2024-12-16T16:14:22.987Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.