{"DetectionScope":"context-only","ResearchEvidence":{"Id":"fda3ff67-12dc-488c-a4c2-603f5bf420bd","Tags":["cg6kwin2k.sys"],"Verified":"TRUE","Author":"Takahiro Haruyama","Created":"2023-11-02","MitreID":"T1068","CVE":["CVE-2024-29216"],"Category":"vulnerable driver","Commands":{"Command":"sc.exe create cg6kwin2ksys binPath= C:\\windows\\temp\\cg6kwin2ksys.sys type=kernel && sc.exe start cg6kwin2ksys","Description":"Sangoma cg6kwin2k versions before 2.1.7.0 expose IOCTLs without sufficient access control. A low-privilege user can perform I/O against arbitrary hardware ports or physical addresses, enabling firmware erasure or modification.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html","https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-003008.html","https://nvd.nist.gov/vuln/detail/CVE-2024-29216","https://github.com/fluffycats31/vulnerable-drivers"],"Detection":[],"Acknowledgement":{"Handle":"@fluffycats31","Person":"fluffycats31"},"KnownVulnerableSamples":[{"Company":"NMS Communications","Date":"","Description":"CG/MG family driver","FileVersion":"2.00 built by: Administrator","Filename":"","MD5":"e3d290406de40c32095bd76dc88179fb","MachineType":"AMD64","OriginalFilename":"cg6kwin2k.sys","Product":"CT Access","ProductVersion":"2.00","Publisher":"","SHA1":"06ec62c590ca0f1f2575300c151c84640d2523c0","SHA256":"223f61c3f443c5047d1aeb905b0551005a426f084b7a50384905e7e4ecb761a1","Signature":"","Imphash":"6c42ea981bc29a7e2ed56d297e0b56dc","Authentihash":{"MD5":"fe2bb16274052394a433f202b2f2c556","SHA1":"65980c174fc4930339ca81f70667439ad10b85cc","SHA256":"8c33314792854eef6c6cc4bd1cc4b00f1feed35e8bd260dd4ab0d93b1f6165af"},"RichPEHeaderHash":{"MD5":"174dcc1f4d118a31686a876b819a7f19","SHA1":"d48fc38a407eaed8bfb247f89a2ad22d69da9e54","SHA256":"75fd010ec23cdc46727239764006ce424df73edfcbbea22833eaf50d7d07b2a5"},"Sections":{".text":{"Entropy":6.3326235330898335,"Virtual Size":"0xae7e"},".rdata":{"Entropy":5.465551715777126,"Virtual Size":"0xf8c"},".data":{"Entropy":2.176116674347563,"Virtual Size":"0x638"},".pdata":{"Entropy":4.478462877824751,"Virtual Size":"0x5b8"},"INIT":{"Entropy":5.063095996432754,"Virtual Size":"0x886"},".rsrc":{"Entropy":3.5311310995023666,"Virtual Size":"0x1430"},".reloc":{"Entropy":3.9098148164589683,"Virtual Size":"0x1da"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2022-09-13 10:32:49","InternalName":"cg6kwin2k.sys","Copyright":"Copyright (C) NMS Communications Corp.2004","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IoDeleteSymbolicLink","ExFreePoolWithTag","RtlInitUnicodeString","IoDeleteDevice","RtlQueryRegistryValues","KeInitializeDpc","KeReleaseSpinLock","IoAllocateErrorLogEntry","KeInitializeTimer","KeSetTimerEx","RtlAppendUnicodeStringToString","IofCompleteRequest","RtlCopyUnicodeString","KeCancelTimer","KeAcquireSpinLockRaiseToDpc","IoCreateSymbolicLink","IoCreateDevice","KeSetEvent","swprintf","KeInitializeEvent","RtlUnicodeStringToAnsiString","MmUnmapIoSpace","PsCreateSystemThread","MmMapIoSpace","ZwClose","IoConnectInterrupt","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlFreeAnsiString","ObfDereferenceObject","IoDisconnectInterrupt","IoWriteErrorLogEntry","IoGetDeviceObjectPointer","IoReleaseCancelSpinLock","KeDelayExecutionThread","PsTerminateSystemThread","KeReleaseSpinLockFromDpcLevel","KeAcquireSpinLockAtDpcLevel","KeQueryTimeIncrement","KeClearEvent","IoRegisterDeviceInterface","IoSetDeviceInterfaceState","IoBuildSynchronousFsdRequest","IoDetachDevice","RtlFreeUnicodeString","PoStartNextPowerIrp","IoGetAttachedDeviceReference","IoAttachDeviceToDeviceStack","PoCallDriver","IoGetDeviceProperty","IofCallDriver","MmFreeContiguousMemory","MmBuildMdlForNonPagedPool","IoFreeMdl","MmGetPhysicalAddress","IoAllocateMdl","MmAllocateContiguousMemory","KeInsertQueueDpc","RtlTimeToTimeFields","ExSystemTimeToLocalTime","KeBugCheckEx","MmMapLockedPagesSpecifyCache","ExAllocatePoolWithTag","KeStallExecutionProcessor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2022-06-07 18:08:06","ValidTo":"2023-06-01 18:08:06","Signature":"0a835e40cdb627d4f0a0d3dbbf64a46a05c132d0b5df9d11cd9c195d7037737057d57a342732ae68d67de47f460e7211c7c40dc29b0a079caff871c4834a9a2fc85e759de9b78659ad6fd79b7320e538e9ba5d52227ad67cc00b0a770ef662af3d743a558643ad89cfb015591709a69b6271a9b65db71898e7cb9964c6376dc474898301a6133198b486b518fdd9d7b9723dcffc441e026833f7c72e27986026c97b9184a0048b10d1fe6847ae467f02173f7a69120be780e5b6b9e6399402cc58735a31b537cc33578fbea443135a4a612359150bcf9ab316f6a9248bc71ef3f3480b9b3fa2341692bc3a121d80214688f7bd87d5ec56dcbd0ea61abf2c7ed2b739a07590adb596d401735d955f5f94c591d69ab4363a42f9fca549d439495711ff7990448c03724792ed4acf31f2b35b136c1b2f37aa82b1aabf7daf059dcb2e976e95311ec6e9cc53876dd09632cf512d39c801849a7c1088a565691953e07c7ff17b22518e982dd2dcc0feda8c834ca1f5e247aef1c3af5f13cd4b8cc1b6c0179bc876db88d677047c34366533e349796dbdea86389ad640710b7742ae8cc4ec88f10fa80ede4b1c93f81b55480fc8228216d54813df0327e74b3db9f3512a40c0568e4215827f9b7a2613deea72a7ec4df2def05e5559015049fe83edc83300526045cb128119e131b7d3573b268e24b0a25b9ad59f6301c8fc8f409322","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000057ee4d659a923e7c10000000000057","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"fdc11a5676aed4e9cc0c09eeb7450dfb","SHA1":"4902077d9a05d4231b791d3b05bafa4a79132f03","SHA256":"5db56c23d83bf67c7152e28ad4a684a7372b4ae4f52afe7a81ce91eef94caec3","SHA384":"c952d7f0e0ea5216ce4400601fb7c0829f0f3fcd6eb2b5b9112fbe45d133e00c4abd660f8e1794f7ac4ef95123e2c0ab"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000057ee4d659a923e7c10000000000057","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"LoadsDespiteHVCI":"FALSE"},{"Filename":"cg6kwin2k.sys","MD5":"a82109dc70202686416ba5fdefe667f5","SHA1":"f30e4838787e43d035fe2bb1b667f129b45b4452","SHA256":"e054f61bb54672b374c6ac0f5d8176407ba43d397bc624ec40e281909724e6c7","LoadsDespiteHVCI":"FALSE","Imphash":"6c42ea981bc29a7e2ed56d297e0b56dc","Authentihash":{"MD5":"49f8506a50c28694bb878a3163e698f7","SHA1":"6843ada92357ed403ca2dfe8f12810cc64bddcd1","SHA256":"24944dd620dc265f435cbac929b3078c72b328dae4a52e95af40e170760c4426"},"RichPEHeaderHash":{"MD5":"174dcc1f4d118a31686a876b819a7f19","SHA1":"d48fc38a407eaed8bfb247f89a2ad22d69da9e54","SHA256":"75fd010ec23cdc46727239764006ce424df73edfcbbea22833eaf50d7d07b2a5"},"Sections":{".text":{"Entropy":6.339870826328148,"Virtual Size":"0xafae"},".rdata":{"Entropy":5.476719284868601,"Virtual Size":"0xfa8"},".data":{"Entropy":2.176116674347563,"Virtual Size":"0x638"},".pdata":{"Entropy":4.476904578968226,"Virtual Size":"0x5c4"},"INIT":{"Entropy":5.063095996432754,"Virtual Size":"0x886"},".rsrc":{"Entropy":3.5311310995023666,"Virtual Size":"0x1430"},".reloc":{"Entropy":3.909814816458969,"Virtual Size":"0x1da"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2024-02-20 13:19:00","Description":"CG/MG family driver","Company":"NMS Communications","InternalName":"cg6kwin2k.sys","OriginalFilename":"cg6kwin2k.sys","FileVersion":"2.00 built by: Administrator","Product":"CT Access","ProductVersion":"2.00","Copyright":"Copyright (C) NMS Communications Corp.2004","MachineType":"AMD64","Imports":["ntoskrnl.exe","HAL.dll"],"ExportedFunctions":"","ImportedFunctions":["IoDeleteSymbolicLink","ExFreePoolWithTag","RtlInitUnicodeString","IoDeleteDevice","RtlQueryRegistryValues","KeInitializeDpc","KeReleaseSpinLock","IoAllocateErrorLogEntry","KeInitializeTimer","KeSetTimerEx","RtlAppendUnicodeStringToString","IofCompleteRequest","RtlCopyUnicodeString","KeCancelTimer","KeAcquireSpinLockRaiseToDpc","IoCreateSymbolicLink","IoCreateDevice","KeSetEvent","swprintf","KeInitializeEvent","RtlUnicodeStringToAnsiString","MmUnmapIoSpace","PsCreateSystemThread","MmMapIoSpace","ZwClose","IoConnectInterrupt","ObReferenceObjectByHandle","KeWaitForSingleObject","RtlFreeAnsiString","ObfDereferenceObject","IoDisconnectInterrupt","IoWriteErrorLogEntry","IoGetDeviceObjectPointer","IoReleaseCancelSpinLock","KeDelayExecutionThread","PsTerminateSystemThread","KeReleaseSpinLockFromDpcLevel","KeAcquireSpinLockAtDpcLevel","KeQueryTimeIncrement","KeClearEvent","IoRegisterDeviceInterface","IoSetDeviceInterfaceState","IoBuildSynchronousFsdRequest","IoDetachDevice","RtlFreeUnicodeString","PoStartNextPowerIrp","IoGetAttachedDeviceReference","IoAttachDeviceToDeviceStack","PoCallDriver","IoGetDeviceProperty","IofCallDriver","MmFreeContiguousMemory","MmBuildMdlForNonPagedPool","IoFreeMdl","MmGetPhysicalAddress","IoAllocateMdl","MmAllocateContiguousMemory","KeInsertQueueDpc","RtlTimeToTimeFields","ExSystemTimeToLocalTime","KeBugCheckEx","MmMapLockedPagesSpecifyCache","ExAllocatePoolWithTag","KeStallExecutionProcessor"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2023-04-06 19:16:30","ValidTo":"2024-04-03 19:16:30","Signature":"46265205ad9b6e72f93c97f9bf34c09a4a9f618fec8b7dd6ec24db2163c8b019835dab33b75917d152e60a82e374a0c824aabd01367487ae41dd80c6e98facf7ab35fb0e21b812444a0740d44e44c100b6edc2d3a5a243594b116a979fae9c2e5a0e8d8b9d3809064110d2427a911e520310562b1a3524d5b3767a94069e35c0a3df4f4e1d11f91c05e35bdcce15a12d0d0083f080b21de4d12c3cd428214ed47c21b2ecf546c3d258c90fc982530b04eb7b84fcad5c7898fb6ce95f8970d0d98ab02d730c33c75ced79ea3b9aa19938e719ad84889325a5de27e97c7715d7130926057292a83f09c89f0b5e3993f32de9f773016ba173520ae0d0559bfb4f78dc8564a66b619af0162abe1b02a812562d5517d681a5f096f73a8414bc414919c173240a48d5dd226caf91c1a7fc25b88d4d407af788d09452b324bdfecb7fbec11569e50dc596319701cdf5bd4e0d3714097054b84be6a9715cbf4d499a25a01114f02aa44973515379ebfa23bf8bbaf931f08fd998c4d63cbe8ca6b062145ba4379ad1fcd5749e226e14596ad99249c8c8009212f4a997cf6e4f4940c14a0d4733bc511189110958a9defce1668953a0ef3f17bd5d588af12fae2de418169c1ad1b3571584fcd7be4875ce8d4c10edfa60652327e39158c64eba0e1db8e85c8d07371603d60d2585a61f39f265d662240813567907809db37b3a38c50c1dab","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000062f45cf99e58a96a89000000000062","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"93c79f426eb2f2a03b74a6275cac238f","SHA1":"e3ae60577ad97b4113d71845e11bd33a1ef2bea8","SHA256":"0f06228de7bacfbf65d426df80c4e40c5abfe5a2a402e6221dea03b18897de2b","SHA384":"4fcbd8696874577fdeed02d6f1245fb7f45d477850cbfdac0db27f478ed500665247ca122157f2678949f85e5386aa71"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000062f45cf99e58a96a89000000000062","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}]}]}}