CVE-2024-12668: Velocidex WinPmem Out of Bounds Write Vulnerability
Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the gCiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12668?
CVE-2024-12668 is classified as a high-severity Out of Bounds Write vulnerability.
How do I fix CVE-2024-12668?
To mitigate CVE-2024-12668, users should upgrade Velocidex WinPmem to version 4.1 or later.
Who is affected by CVE-2024-12668?
CVE-2024-12668 affects all versions of Velocidex WinPmem prior to 4.1.
What kind of exploitation is possible with CVE-2024-12668?
CVE-2024-12668 can be exploited to write arbitrary memory locations by manipulating IO Control requests.
What is the potential impact of CVE-2024-12668?
Exploitation of CVE-2024-12668 may lead to information leakage and compromise system integrity.