Velocidex Winpmem vulnerabilities
2 vulnerabilities
Known vulnerabilities in Velocidex Winpmem, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2024-10972velocidex · winpmemWinPmem Improper Input Validation vulnerabilityVelocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being performed at the beginning of the routine allowing the userspace to change page permissions half way through the routine. A valid workaround is a rule to detect unauthorized loading of winpmem outside incident response operations.EPSS0.16%HighCVE-2024-12668velocidex · winpmemVelocidex WinPmem Out of Bounds Write VulnerabilityVelocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers.EPSS0.21%