{"DetectionScope":"context-only","ResearchEvidence":{"Id":"1757aa0e-0e7c-477a-b224-a73ce07b9e3b","Tags":["virtio_rng.sys"],"Verified":"TRUE","Author":"Andrea Monzani","Created":"2026-10-25","MitreID":"T1068","CVE":["CVE-2025-8412"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create virtio_rng binPath=C:\\windows\\temp\\virtio_rng.sys type=kernel && sc.exe start virtio_rng","Description":"A vulnerable kernel driver that can be used to disable Code Integrity","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://web.archive.org/web/20160808182709/https://kat.lua.cz/posts/Some_fun_with_vintage_bugs_and_driver_signing_enforcement/","https://doi.org/10.1016/j.cose.2026.105194"],"Detection":[],"Acknowledgement":{"Person":"Andrea Monzani, Davide Netti, Antonio Parata","Handle":""},"KnownVulnerableSamples":[{"Filename":"virtio_rng.sys","MD5":"90efcd59ca7522d9733d1493589a2676","SHA1":"2a1623c931152f906240de1a50ec9a1e6271f7e6","SHA256":"1f0ed057b98e7242b7a3a23fbfb05a4b9d29726132705948ce70045369152f10","Imphash":"a146c524ad562ffdb24af0e97da6af14","Authentihash":{"MD5":"adab0078e3081974460da5d5ffb7484c","SHA1":"02c80a03d1d09eb2251aeaa20bee8abb2b4f096c","SHA256":"db421ce2f3379a515ae545f9c7e44be0484c91513b7fac4f379f9191cd7b41fd"},"RichPEHeaderHash":{"MD5":"5bcc37de4015676d39439577ea18640f","SHA1":"cca5ccf5afbc7d009064855b40ef6f4a98171c2d","SHA256":"07a888bcb5759602d32d4ec7f94ae0f9e6d256c8419ee4de59fca3dd62fd2745"},"Sections":{".text":{"Entropy":6.33356054773931,"Virtual Size":"0x8f06"},".rdata":{"Entropy":4.636337104610637,"Virtual Size":"0xc30"},".data":{"Entropy":0.4429013514393896,"Virtual Size":"0x160"},".pdata":{"Entropy":4.31975211285497,"Virtual Size":"0x4c8"},"PAGE_PWR":{"Entropy":5.657773650114776,"Virtual Size":"0x228"},"INIT":{"Entropy":5.411321778234934,"Virtual Size":"0x72c"},".rsrc":{"Entropy":3.3577487185740433,"Virtual Size":"0x3d8"},".reloc":{"Entropy":3.6348937534189765,"Virtual Size":"0x24"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-08-10 18:52:44","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["RtlQueryRegistryValues","MmGetSystemRoutineAddress","KeInitializeDpc","KeInitializeSpinLock","IoAttachDeviceToDeviceStack","IofCallDriver","IofCompleteRequest","IoCreateDevice","IoDeleteDevice","IoRegisterDeviceInterface","PoStartNextPowerIrp","KeGetCurrentIrql","KeAcquireInStackQueuedSpinLock","KeReleaseInStackQueuedSpinLock","ExFreePoolWithTag","IoAcquireCancelSpinLock","IoDetachDevice","IoReleaseCancelSpinLock","PoCallDriver","KeInsertQueueDpc","RtlInitUnicodeString","MmGetPhysicalAddress","KeInitializeEvent","KeDelayExecutionThread","KeWaitForSingleObject","IoBuildSynchronousFsdRequest","IoGetAttachedDeviceReference","ObfDereferenceObject","ExAllocatePool3","MmAllocateContiguousNodeMemory","MmFreeContiguousMemory","KeSetEvent","MmUnmapIoSpace","MmMapIoSpaceEx","IoConnectInterrupt","IoConnectInterruptEx","IoDisconnectInterrupt","IoDisconnectInterruptEx","IoSetDeviceInterfaceState","PoSetPowerState","RtlUnicodeToMultiByteN","ExAllocatePool2","wcsstr","KeStallExecutionProcessor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Utah, L=Provo, O=SUSE LLC, OU=SUSE Labs, E&I, serialNumber=001073307, CN=SUSE LLC, ??=Private Organization, ??=Massachusetts, ??=US","ValidFrom":"2020-08-13 23:02:35","ValidTo":"2023-08-13 23:02:35","Signature":"9f23cc604c71544ea66fd679586dc4dfe3c0fcdca3d07cbab981950163b8742ba57addcaf1deac88601080f67a6b80abc0bfed1a6c06fddb5f30b5d88f0ff74039b6002fc30679bb976e470fe25bbc00078890480d7c4462fc5f7ce58ec2bbc1730782b16799fd6e2ec7a4322aa84f8bd17b658bd9fa7e9536db81a14bdbc5b8fa12805116a0df1896994b370818ba697ab45e3ee96c7bd185ed8d3d490e3a26624974f24948e69278f8ab9610172f85c80232966b1f1874b2e37b8573436f73777cb2025c76af4b0d3455b6e9131b4037e368f811fc424376b88f654212f747cf631dbb7a9e0d50c6e91113f298e53d83fd83997f0256715d3985800482a57bab4bf14c23b9cffe220e87b59d6b13ade62c7b4fa5b010ff38c40e69d34863c6d9823a27a66fcf86acea9c5f3a65c7429203f30e70a9d8a5d39c09d79a419ce1eddc96cbf5b706c874ee732f1f796bcaed20fed6459ac89394fbbefefc3df39bb01e64ab8abeeafd6c92323314153c69a36834771a4c641982393ff4db0880699ddcf7fe8f50d51c0552791e054442aec3b8c6acc07691d6943d04573cb42a20a1a5252efcd6dc81a447b73d4ba68ee1b9f6ad9277f87c89e529b96b549402459def9782d9add8761e46e252607806aa8856a50c1a39e6da6446754eb4dc14ba8762d6ad95b301242c42977f04985edc6431b8ff58902d09f7837b22b91167eb","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"390c243ab43d99feed67815a7d014766","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"d49bbc4be9eb99799f23a22276989dc3","SHA1":"cea1af2bb44230fb0ed489ebe680421eabf72da1","SHA256":"5a3520589dac819dfa97605e62b9ee06badca54f434a595ef9d2277a97823fcc","SHA384":"4e3c192502e6fef30933911594f81088f46db57dde81308d19d9e39ecfe683e93aa93dcec23b93e16334838933c76fd8"}},{"Subject":"C=US, ST=Texas, L=Houston, O=SSL Corp, CN=SSL.com EV Code Signing Intermediate CA RSA R3","ValidFrom":"2019-03-26 17:44:23","ValidTo":"2034-03-22 17:44:23","Signature":"728ffa81488291e26083255b7b8f2f940f8358ce8824fa99424e2d4e3789f89fb11eae744079f9decbf7ff2c25105298408f5438ff5dd12aa95ae6b702bbc87fee2ad3ff7fcc363c5529435d364996265d70e7f22b0567474c99581908f6b1c64f60d2fc38be02ac25d1880da52ce1ddd37d57cf6ac31960d26daa5d7b44e85a5b83dbc81b360a7e0af50a523678e29afb1354cc9cc947bf624e35af3ee1ba0fc993eed520b796b7507652357a9da13b2664371fcebc037bc461815289cc7bfe5a051a47aee412ca8e54e35a9fb0c18af2f95f4668b9afc7d93e84d12b2512383dbb9a01eadfcc66a8b6c51f6a9347b0ce069284ad43836a86395c4ce2024b7873ae4b28e6a4f8616980ccff34e8b02f6402490d8d2e1f7deba186050fed5e7034e5180200eb63be75266da71c905707ae99a58e37d2a7c3586ca5f4e7522235a75bbb6eeb48db9a72deaa5a6249099e902b120fc83adbaf68739dd9e379ca98f9681deae6582ea9186ccd993a9acd267044e666989c251e196ac7d8f3e7ffa63577fbf57dbb8c82c76f7d5432bbea990b39e82051152f89e32ae1c520f37a784e3daf176292548d278c9037dce329e84293b6f83b2b0b9950b8e434069823eeeadfb554bbaedbf1eadd72f945edb1da433b80fc6f6cdfdc916db8a5d4ef75cd654c642c59df132e021b4bfa0493c0bb371d1fb220d34f33af16a11cc0aaa888","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"424b6a53cec766141c2a63b1a51c4104","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"db3494d2a0da480f9a2dc03978395f8a","SHA1":"9cb274c1f98981dbdbe1a7630a9071458784c80d","SHA256":"49b229a10f850de5b85110a0e0f59c48dd12b116c9ad236a3f16c5bdfbc968d5","SHA384":"2012fa0acaa171e7e953cfad3301af5dc2947a64428d9fdc7bcd47afe88ab85fa580e0ed6d0f61e9629d46accc3b48ec"}}],"Signer":[{"SerialNumber":"390c243ab43d99feed67815a7d014766","Issuer":"C=US, ST=Texas, L=Houston, O=SSL Corp, CN=SSL.com EV Code Signing Intermediate CA RSA R3","Version":1}]}]}]}}