← Back to driver explorer
Driver intelligenceVulnerableVerified
nipalk.sys
nipalk.sys is the NI-PAL core kernel driver. The tracked 18.0.0f0 build is within NI-PAL versions before 20.0.1f0 affected by CVE-2021-38304, where improper input validation can allow a local user to escalate privileges. The separately tracked 25.8 build is not attributed to that CVE; exact analysis of that build found physical-memory mapping, virtual-to-physical translation, DMA allocation, bus access, and PCI configuration operations reachable through its IOCTL service gateway.
Known samples 2
0 recorded TRUE · 1 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
nipalk.sysSample 1 · HVCI FALSE
- MD5
a2aa28c34f463e231af56226f1aaea5d- SHA1
75c86d280f6b3e1034668e065f30bffcc4e50d7d- SHA256
1a6b4d5ad40c9ddf2599f6a44e94a1336aa3d28bf6a220b775f5c3305faecb2d- Imphash
830e72c6966821b4022e4ce6ac982c64- Authentihash MD5
1ddf5dcec07f2cdfc19ce739b92c8439- Authentihash SHA1
e5d09ec32d7d3e4eb36c13ef9dafcdc9bc02f164- Authentihash SHA256
d49d6e44d1333ebec32b024d57be1cfa6154bc1db880cd7b89214e754ea240fe- Machine
- AMD64
- Version
- 25.8.0f138
- Publisher
- National Instruments Corporation
nipalk.sysSample 2 · HVCI unknown
- MD5
484758b8103a25b25e0d8fe656fd1238- SHA1
c649fa5e592b47fc1123f3efb1a92c584923adfb- SHA256
d01c734b309a4ee5425afbb1a3181fcecffe5281dd6d654793a33394fd6b8e10- Imphash
357075b56e12f618aaa67809a3d498a5- Authentihash MD5
5b53ce34d5ede9fd58a05d5e530b0541- Authentihash SHA1
19f020576d726482b122f4931d8540d858449bb4- Authentihash SHA256
d588709e2a99d785c3bf6c122ae9310f7aebf775e403af3c315e122ae88f4b1a- Machine
- AMD64
- Version
- 18.0.0f0
- Publisher
- National Instruments Corporation
Recorded command
sc.exe create nipalk binPath=C:\windows\temp\nipalk.sys type=kernel && sc.exe start nipalkElevate privileges · Privileges: User · OS: Windows 10
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/303
- https://github.com/magicsword-io/LOLDrivers/issues/409
- https://github.com/fluffycats31/vulnerable-drivers
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-input-validation-in-ni-pal.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-38304
Acknowledgement: Patrick Saif, fluffycats31 @weezerOSINT, @fluffycats31