CVE-2024-12668

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12668
Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/Velocidex/WinPmem/releases/tag/v4.1.dev1
Configurations

No configuration.

History

15 Apr 2026, 00:35

Type Values Removed Values Added
Summary
  • (es) Las versiones de Velocidex WinPmem anteriores a la 4.1 sufren una vulnerabilidad de escritura fuera de los límites. Al usar un control de E/S, un programa de espacio de usuario puede engañar al controlador para que escriba un 0 en cualquier ubicación de memoria elegida. Junto con la fuga de información del controlador WinPmem, los atacantes pueden descubrir la ubicación en la memoria del símbolo global g_CiOptions. Esto se puede aprovechar para desactivar la aplicación de controladores firmados en el sistema de destino, lo que permite a los atacantes cargar controladores no firmados.

16 Dec 2024, 17:15

Type Values Removed Values Added
Summary (en) Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability whereby an attacker can subvert code-signing facilities leading to the ability to write the value zero anywhere in memory with the driver – without using the\nPMEM_WRITE_ENABLED compilation flag. This issue is remediated in version 4.1. (en) Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the location in memory for the g_CiOptions global symbol. This can be leveraged to disable signed driver enforcement on the target system - allowing attackers to load unsigned drivers.

16 Dec 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-16 15:15

Updated : 2026-06-17 07:00

NVD link : CVE-2024-12668

Mitre link : CVE-2024-12668

CVE.ORG link : CVE-2024-12668

JSON object : View

Products Affected

No product.

CWE
CWE-787

Out-of-bounds Write