LenovoDiagnosticsDriver.sys
Lenovo Diagnostics versions before 4.45 are covered by CVE-2022-3699. The vulnerable driver behavior tracked here is limited to confirmed 1.0.2.0 through 1.0.4.0 LenovoDiagnosticsDriver.sys builds. Their low-user device ACL exposes FILE_ANY_ACCESS IOCTLs 0x222010 and 0x222014, which map caller-selected physical addresses and provide unrestricted physical-memory read and write primitives. Later 3.1.0.0 code removed the write path, denied Builtin Users, and limited reads to allowlisted PCI registers, so that build is not tracked here.
Known samples 4
0 recorded TRUE · 2 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
LenovoDiagnosticsDriver.sysSample 1 · HVCI unknown
- MD5
b941c8364308990ee4cc6eadf7214e0f- SHA1
b89a8eef5aeae806af5ba212a8068845cafdab6f- SHA256
f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe- Authentihash MD5
56b6144e389ce3b1e2a0a96a954aa7d8- Authentihash SHA1
6d9543725aca0c9c8f403425952692ccc1d2d7f2- Authentihash SHA256
34e6a56c60746c51034b45a7b2a36617205b598d0bbcc695f92404605a0975d5- Machine
- AMD64
- Version
- 1.0.4.0
- Publisher
- Lenovo Group Limited (R)
LenovoDiagnosticsDriver.sysSample 2 · HVCI FALSE
- MD5
121ee36aea275809e6dca642fa069091- SHA1
a15049e59691214018ca1a6c063e080ab789422e- SHA256
279cf7f22d08724fa346b8138a35cda22ff4bb7a6d19d2d44e8905b0e9634dfd- Imphash
225e24ee3c4081a16ef32831b70bf8ef- Authentihash MD5
ee7f812973c3f68005863528be8929cf- Authentihash SHA1
16270f2017ed1a0d601084ca4b20d3ea2403d1a4- Authentihash SHA256
54e111f07f7bdc0b1ae23acac65381f4d1feb16527ce29091ffc394c7325b824- Machine
- AMD64
- Version
- 1,00,02,0
- Publisher
- Lenovo Group Limited (R)
LenovoDiagnosticsDriver.sysSample 3 · HVCI FALSE
- MD5
e0ae49af6741ca8b83b2246cf858f779- SHA1
69b2f9735ccaf06c5ba3cd5205e5ffff31e08bc1- SHA256
b4dddea3fed5881aadcc8cce86eb2a50b613b6041bc63477fee4a8e6b0db65f1- Imphash
225e24ee3c4081a16ef32831b70bf8ef- Authentihash MD5
56b6144e389ce3b1e2a0a96a954aa7d8- Authentihash SHA1
6d9543725aca0c9c8f403425952692ccc1d2d7f2- Authentihash SHA256
34e6a56c60746c51034b45a7b2a36617205b598d0bbcc695f92404605a0975d5- Machine
- AMD64
- Version
- 1.0.4.0
- Publisher
- Lenovo Group Limited (R)
LenovoDiagnosticsDriver.sysSample 4 · HVCI unknown
- MD5
a241964e5a88ce4135988ac18e684f3c- SHA1
8632b636ab472c5b64c06d9a4dd430ff55ddbf77- SHA256
93cb6b6879fc9fd71b9539265ec3d5d1969cc00cfe2758979a03d7c19cdc0e20- Imphash
225e24ee3c4081a16ef32831b70bf8ef- Authentihash MD5
07df389fae77608be3385555e643df1e- Authentihash SHA1
32ce4c31385edeeef7145678d3895101e3130e04- Authentihash SHA256
970a4c44b046eff139c9c2ea11ef7ccadcbc93612b41afc0a947cceda0ca5a39- Machine
- AMD64
- Version
- 1,0,3,0
- Publisher
- Lenovo Group Limited (R)
Recorded command
sc.exe create LenovoDiagnosticsDriver.sys binPath=C:\windows\temp\LenovoDiagnosticsDriver.sys type=kernel && sc.exe start LenovoDiagnosticsDriver.sysElevate privileges · Privileges: User · OS: Windows
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/409 ↗
- https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules ↗
- https://nephosec.com/cve-2022-3699-lenovo-diagnostics-driver-eop-arbitrary-r-w/ ↗
- https://github.com/alfarom256/CVE-2022-3699 ↗
- https://support.lenovo.com/us/en/solutions/ps500533-lenovo-diagnostics-vulnerabilities ↗
- https://nvd.nist.gov/vuln/detail/CVE-2022-3699 ↗
- https://github.com/fluffycats31/vulnerable-drivers ↗
Acknowledgement: Mike Alfaro, fluffycats31 alfarom256, @fluffycats31