← Back to driver explorer
Driver intelligenceVulnerableVerified
PGPwded.sys
PGPwded.sys and eedDiskEncryptionDriver.sys are Symantec drive-encryption filters affected by CVE-2019-9702 and CVE-2019-9703. Symantec Endpoint Encryption releases before 11.3.0 and all Symantec Encryption Desktop releases are affected. The tracked filters expose raw-sector read and write controls. In the 11.1.1 eedDiskEncryptionDriver build, any-access IOCTLs 0x8002206C and 0x80022070 select a tracked volume and read or write sectors; its protected-range logic still permits writes beginning in sectors 0 through 2, leaving boot-sector modification possible.
Known samples 7
0 recorded TRUE · 0 recorded FALSE · 7 unknown for loading despite HVCI. Results apply to individual samples.
PGPwded.sysSample 1 · HVCI unknown
- MD5
cf433fa0463e9fba56102bc1436ef7f3- SHA1
48f0e0856707e7cb82fd4e962dcac02a8625d8e0- SHA256
02579d833200abb641e476468bafd1f07d448f3d232f70cc34e2adad402b5c75- Imphash
a4359099176fcbc68e8bf3089cb9a264- Authentihash MD5
000df31531ddeff7cf6371a275488c13- Authentihash SHA1
8d0ec5ca2af79cbb5883830fe1906dbf81d150f6- Authentihash SHA256
23354a3a8bcc7d51afca16590c18d158f5eddc41379284d4ac373a76029efcab- Machine
- AMD64
- Version
- 11.0.1 (Build 640)
- Publisher
- CA, Inc., a Broadcom subsidiary
PGPwded.sysSample 2 · HVCI unknown
- MD5
555705000dd726b10432d3bcf9e36c54- SHA1
72602fe173a375988b5c3d3a1bbb956fd8fe1f08- SHA256
2bb84d2b3af3d9ee0f2dbcdfe3574a5c576bc2c7dd2a5b3dbcb7784fbc9efec6- Imphash
e676b7c75a8af537e52df8305bcb16c7- Authentihash MD5
cda325bb8b11396d637794e11c74f0d0- Authentihash SHA1
212d7c603c470f1a5c89bd66c774b01fa81f292c- Authentihash SHA256
7a0a29159ad02be390afc0759c8ab257d4fb32e156c0507503d32575e558c8fa- Machine
- AMD64
- Version
- 10.5.0 (Build 1393)
- Publisher
- CA, Inc., a Broadcom subsidiary
PGPwded.sysSample 3 · HVCI unknown
- MD5
99e8631183314b2bd136de34c02c7b09- SHA1
1c13bc569c84a0616fad95bc65d63216e1169523- SHA256
5247d4ab237e8fc486ce95d018bd92074b2a8cf1af351cd699a5b4a9355c7071- Imphash
e676b7c75a8af537e52df8305bcb16c7- Authentihash MD5
7b12d85f3f90d4c593ceccbf500ff1dd- Authentihash SHA1
f6eddbb0c70c3f703720e5af99ec163afd9cc209- Authentihash SHA256
ba28cd5ddcd1cc4e5a0683f042600bd11f7023ccb31f060fcfcf8de7564d8ca3- Machine
- AMD64
- Version
- 10.4.2 (Build 463)
- Publisher
- Symantec Corporation
PGPwded.sysSample 4 · HVCI unknown
- MD5
e7bc75d787e88ca7b6b3797ea8c4f376- SHA1
33caf07739768023bf156cde226bd4d0ec85e864- SHA256
6dd193dd6d60f08482a85e23d3c434f540fd38488281aea0f87ec5e9a1a8e4d9- Imphash
e676b7c75a8af537e52df8305bcb16c7- Authentihash MD5
fe33dac8f6a616d62abf8f4103eacba9- Authentihash SHA1
4cec00b8168755893b8f08973aab477183706601- Authentihash SHA256
7a62b0aef4ffa0e0e20f02260d37bf507f5b5c04619ae880146ef4dbb3044a96- Machine
- AMD64
- Version
- 10.4.2 (Build 317)
- Publisher
- Symantec Corporation
PGPwded.sysSample 5 · HVCI unknown
- MD5
ef4d6fa6679fc8dfa9d223408124c884- SHA1
8148913cb9a748b8d9d1ad5863e8075ceee6f10f- SHA256
90c7fe509129a8095319c3d4ce7e867f503321a1d41d23b674dcf2adfd7424fa- Imphash
a4359099176fcbc68e8bf3089cb9a264- Authentihash MD5
d92486c7ae23002234964b8b403a69e6- Authentihash SHA1
ac40ff2c75649245653fe1230d6056371b040de4- Authentihash SHA256
01447fccc18760cdbe70f3eb020d5944d56926bcd16da2cc3a07236e87e89a9f- Machine
- AMD64
- Version
- 11.0.0 (Build 976)
- Publisher
- CA, Inc., a Broadcom subsidiary
eedDiskEncryptionDriver.sysSample 6 · HVCI unknown
- MD5
d5f0f35134135206dd1986b4c8b19794- SHA1
5c757a3f97b15fc44550c5853eefcd2cc5f90997- SHA256
435f56a1f5bf3f89a29125b4e42396bb8d1499d20a5d4db865a35df23c41844f- Imphash
b99820bacc2b77dc46693f68369d79c1- Authentihash MD5
0093d69ee026ec06fbd518dfe0984e45- Authentihash SHA1
6a2d6498b6300061830208a7081dedfe3a7b19f8- Authentihash SHA256
792f87a87cef485e0d41c43096cf36233299ef6457688bb35b1f68c42dfb9831- Machine
- AMD64
- Version
- 11.1.1 (Build 1200)
- Publisher
- Symantec Corporation
eedDiskEncryptionDriver.sysSample 7 · HVCI unknown
- MD5
29b98854c8dbf6f7859ec913b09fc185- SHA1
fceae2e110919fcbb953d75d460bc55e3e4165b9- SHA256
fab797f9e498b078dbea8c05e7ddcf157db9aa902e2f7c0e89e21c1308867f16- Imphash
b99820bacc2b77dc46693f68369d79c1- Authentihash MD5
511fecad28c220398c026a5730c9571b- Authentihash SHA1
f5bc1f93fb491cf96608959bdfd48d9d4d8319ac- Authentihash SHA256
c60e5c41c65ea34c8cda7eac06018fd33feb2b43d5b283275e87f161fd259fea- Machine
- AMD64
- Version
- 11.1.3 (Build 554)
- Publisher
- Symantec Corporation
Recorded command
sc.exe create PGPwded type= kernel binPath= C:\\windows\\temp\\PGPwded.sys && sc.exe start PGPwdedElevate privileges · Privileges: User · OS: Windows
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/409
- https://github.com/fluffycats31/vulnerable-drivers
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/0/0/symsa1485
- https://nvd.nist.gov/vuln/detail/CVE-2019-9702
- https://nvd.nist.gov/vuln/detail/CVE-2019-9703
- https://github.com/DavidCarliez/CVE-2019-9702_Symantec_Encryption_Desktop_LPE_PoC
Acknowledgement: Kyriakos Economou, fluffycats31 @kyREcon, @fluffycats31