{"Id":"b9216fc9-860e-43ae-8db2-e970c7e76b46","Tags":["pskmad.sys"],"Verified":"TRUE","Author":"Xusheng Li, Michael Haag","Created":"2026-09-18","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"","Description":"Panda Security's pskmad.sys 1.1.0.23 exposes a memory-read interface protected by a caller-supplied named-event and shared-section authentication exchange. An administrator-controlled process can satisfy that exchange and use the accepted handle to read memory through IOCTL 0xB3702C08. Static analysis of this exact sample confirms a path that copies from valid kernel virtual addresses into the IOCTL output. The device grants access to administrators and LocalSystem; this is not a standard-user entry point. This record tracks the newly reported authentication weakness, not the older Panda CVEs, and does not establish affected versions beyond this exact sample.","Usecase":"Read kernel memory through a forgeable client-authentication exchange.","Privileges":"Administrator or LocalSystem with access to the loaded driver.","OperatingSystem":"Windows"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/434","https://xusheng.dev/posts/byotc/main/"],"Acknowledgement":{"Person":"Xusheng Li","Handle":"@xusheng6"},"Detection":[],"KnownVulnerableSamples":[{"Filename":"pskmad.sys","SHA256":"9bf3b737afa4d4f5e7b00ec749d4b75656ad66d9a2b402e1e81934e95ba7df5b","MD5":"43fe428d3e109c81bb1737afd0f9bfa6","SHA1":"7be590049b5396056f2384a3b56bf2db11b286e1","Imphash":"7170ec91f64a93d0b46d51b933b99cca","Authentihash":{"MD5":"32053f9201fb51142637e36bb0f63c99","SHA1":"611678a21e02e30ac5baeeb9bcaf2fe12a91900e","SHA256":"5fdb1e7e324f6a5537d63e92f5d8ee7d92891f36171665fbd2d1e73e3db1935f"},"RichPEHeaderHash":{"MD5":"09d95440f9fa16467a1c201e07048b47","SHA1":"a01a5d2dd5fb8cd8e7e720b40ccf47c4554d8aad","SHA256":"e3dd4b9d21355cf990fe2d0043aeb02dafb9b96a6783fa47b1beb49f6802281c"},"Sections":{".text":{"Entropy":6.29845689233769,"Virtual Size":"0x58e8"},".rdata":{"Entropy":4.5631748141117505,"Virtual Size":"0xda0"},".data":{"Entropy":1.121598265667852,"Virtual Size":"0x14c0"},".pdata":{"Entropy":4.416676760087232,"Virtual Size":"0x4f8"},"PAGE":{"Entropy":6.232606811848122,"Virtual Size":"0x1a47"},"INIT":{"Entropy":5.192969534334587,"Virtual Size":"0xeb2"},".rsrc":{"Entropy":3.327241903993888,"Virtual Size":"0x368"},".reloc":{"Entropy":1.207239864562246,"Virtual Size":"0x60"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2023-12-14 13:37:18","Description":"Panda Kernel Memory Access Driver (x64)","Company":"Panda Security, S.L.U.","InternalName":"PSKMAD_64","OriginalFilename":"PSKMAD_64","FileVersion":"1.1.0.23","Product":"Panda Technologies","ProductVersion":"1.1.0.45","Copyright":"© Panda 2023","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["RtlInitUnicodeString","MmGetSystemRoutineAddress","IoGetCurrentProcess","ZwOpenEvent","sprintf","ExAcquireResourceExclusiveLite","ExAllocatePoolWithTag","ZwCreateKey","ExFreePoolWithTag","KeLeaveCriticalRegion","ExInitializeNPagedLookasideList","ZwMapViewOfSection","IoDeleteDevice","swprintf","RtlGetVersion","KeEnterCriticalRegion","ZwWaitForSingleObject","ZwQueryValueKey","ZwSetEvent","ZwUnmapViewOfSection","ExReleaseResourceLite","ZwClose","IofCompleteRequest","RtlCharToInteger","ExDeleteResourceLite","IoCreateSymbolicLink","PsGetCurrentProcessId","wcscspn","ExInitializeResourceLite","ZwOpenSection","ExDeleteNPagedLookasideList","MmSystemRangeStart","MmUnmapLockedPages","PsProcessType","KeSetTargetProcessorDpc","KeQueryActiveProcessors","ExReleaseFastMutexUnsafe","KeResetEvent","KeReadStateEvent","RtlAnsiStringToUnicodeString","ZwFsControlFile","PsLookupProcessByProcessId","InitializeSListHead","ZwQuerySymbolicLinkObject","ZwSetEaFile","ZwReadFile","KeSetPriorityThread","KeSetEvent","ExpInterlockedPushEntrySList","IoCreateFile","RtlInitAnsiString","MmHighestUserAddress","KeInitializeDpc","KeReleaseSpinLock","ExpInterlockedPopEntrySList","MmUnmapIoSpace","MmBuildMdlForNonPagedPool","ZwOpenSymbolicLinkObject","IoFreeMdl","MmGetVirtualForPhysical","ZwSetInformationFile","ExAcquireFastMutexUnsafe","KeDetachProcess","KeDelayExecutionThread","RtlFreeUnicodeString","MmGetPhysicalAddress","PsCreateSystemThread","MmMapLockedPagesSpecifyCache","ZwQueryDirectoryFile","PsTerminateSystemThread","MmIsDriverVerifying","MmMapIoSpace","KeInsertQueueDpc","ZwQueryEaFile","ZwQueryVolumeInformationFile","ObReferenceObjectByHandle","MmProbeAndLockPages","KeRevertToUserAffinityThread","MmUnlockPages","ObfReferenceObject","KeSetSystemAffinityThread","MmIsAddressValid","ObfDereferenceObject","ZwCreateSection","KeNumberProcessors","ZwQueryInformationFile","KeWaitForMultipleObjects","ZwWriteFile","ObReferenceObjectByPointer","ObOpenObjectByPointer","KeStackAttachProcess","IoAllocateMdl","KeAcquireSpinLockRaiseToDpc","ZwQuerySystemInformation","KeBugCheckEx","IoCreateDevice","ZwSetSecurityObject","IoDeviceObjectType","_snwprintf","RtlLengthSecurityDescriptor","SeCaptureSecurityDescriptor","RtlCreateSecurityDescriptor","RtlSetDaclSecurityDescriptor","RtlAbsoluteToSelfRelativeSD","IoIsWdmVersionAvailable","SeExports","wcschr","_wcsnicmp","RtlLengthSid","RtlAddAccessAllowedAce","RtlGetSaclSecurityDescriptor","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","ZwOpenKey","ZwSetValueKey","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:28","ValidTo":"2024-04-03 19:16:28","Signature":"0449290d26112d6053cc65c76ab953df62d870517fec16470e3bef28a20b21c099f4609adc713af367ac47fe49cb0f22c001e774ca0c9b13e86c59ec4b03ccdff30a8d38960e09584a895e6a87b0a481a57dc0ef10819ce8b226667f6a646adff7bfa61981a31ed6890e65afa47e7f27991e13fe39a54544aff9116bf5a737a4c33c92c1659a58b33cf3aa94b997e0c636f30e90776eb343874c6e0c7efa3a2d135ec3dd781b97e6ad41fc21adc7bd9b2d9b49e504a32846f541349c64f41396b43622015916fe46907431768a58c24e3f8d46c5cd8276fa1d92ba7aab4ccd77c5f7778b3fa0f5afa6fe6bfdba544b5af0a8597a073b0c7eed8caa5a11cb9dc4c415c8119bd2545f77b93886c40842a9b28b3128bcd257a4365c1e7afa22a5a2d46b936ed7ff7fa1db7801f26552c3ebd7832cc9475390ecbf3898855d16f270652b7fcc319d2415e2b10e8f61f0f4b6c7187739ed7752978fe4870650f3cd838f19b9c43804324f093eba2591c09cdcd46f1f0f8ad10779eed7467030721563f4e810982b42f8c6dfcfd0401d4569a74ccc13df5a9d2347883e776e98ed7fb32bb3f99c688e30b92c78c756b5242c632e5692a5bf564060961f5d55cfb82f150a50714885b378ce803b505b52c99ee339d84f6b9a5e6b86819c525088d9785771e3d1ed24746abd12bd6348a11e5a1cb545228aa270d3ac67b9dcd93d19fdf4","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"686c5dd3e6c0c4d6888c652ee9a76e0b","SHA1":"48c84f19d968d167bb3dad0bfeffcc659269aa03","SHA256":"1fe207964146bdf934dc0c17aefaa75e78aea3d6a3935cc96e64511d7d469b29","SHA384":"6a4750403abdcdb9a23184d3d5ccdb537c32933818740e3531afbc162d90bdee62592e16e7b920dba759938d469cbe49"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000061c88b129c2a7f1d87000000000061","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Signature":["Microsoft Windows Hardware Compatibility Publisher"]}]}