← Back to driver explorer
Driver intelligenceVulnerableVerified
LnvMSRIO.sys
LnvMSRIO.sys is a Lenovo Dispatcher driver affected by CVE-2025-8061. The tracked 3.0.2.28 through 3.1.0.36 builds predate Lenovo's fixed 3.1.0.41 driver. The WinMsrDev interface exposes physical-memory read and write through IOCTLs 0x9C406104 and 0x9C40A108 and MSR read and write through 0x9C402084 and 0x9C402088, allowing an authenticated local user to execute code with elevated privileges when Memory Integrity is not enabled. IronChain ransomware drops the 3.1.0.29 sample as BootRepair.sys, but per ANY.RUN's static analysis it opens \\.\BootRepair instead of \\.\WinMsrDev and uses an unrelated IOCTL, so the driver interface is not actually used.
Known samples 10
0 recorded TRUE · 2 recorded FALSE · 8 unknown for loading despite HVCI. Results apply to individual samples.
LnvMSRIO.sysSample 1 · HVCI unknown
- MD5
96b3465553341b1eb05a2cb2c4140f6b- SHA1
09528272cbefb4747bb07cdaed6b6f5cb5d3569f- SHA256
977d3b78bdf5723430e2e21cf1eb515a2335a0e370c76fa2dda4315ba062f429- Imphash
3b2a2be6141c8dd9d480fe7ab5ede02b- Authentihash MD5
8a08d25e33515c4b8882579d22c58394- Authentihash SHA1
5c3d7ee9031623022dd88b244d74ffad2ddae3f5- Authentihash SHA256
654641f7d5e71471cfe67c6afbb443b36d65cb76918ee6c9173ce3002fafe76a- Machine
- AMD64
- Version
- 3.1.0.29
- Publisher
- Lenovo
LnvMSRIO.sysSample 2 · HVCI FALSE
- MD5
517917ff2e5008c791d007cecab5e335- SHA1
f496bc9b6e77fef03f945b48f86b840baf61fe47- SHA256
7023f08c9f99076a5fb82a0f661847e2951800f095fca1793a0e6bd9c949b478- Imphash
3b2a2be6141c8dd9d480fe7ab5ede02b- Authentihash MD5
74f2be8834f3ac2de12d64b705bf5d08- Authentihash SHA1
b74a2e4f0a40748a9dc136cd7eaceecbfe40bba0- Authentihash SHA256
bcc5394705e552d0312592c507b71a6bd921782f82bb5b4acc721d2f056030a5- Machine
- AMD64
- Version
- 3.1.0.36
- Publisher
- Lenovo
LnvMSRIO.sysSample 3 · HVCI FALSE
- MD5
e2b952939b8e9d76cff7d130b797a74d- SHA1
0186912447648a5e4b9c9c31d718f605d5e5c925- SHA256
245b6ab442a7d53dc30ece28e1c6de727c019669385877cbe929b81aa1a2ad2f- Imphash
3b2a2be6141c8dd9d480fe7ab5ede02b- Authentihash MD5
0534526a3718f09d57d41ee52bac6925- Authentihash SHA1
68969b2b53412322917be77774b3175155f28b71- Authentihash SHA256
5ea22a51f3db36d0fb6f14787a66422b408411f05108c3a75a702eb77870c022- Machine
- AMD64
- Version
- 3.1.0.35
- Publisher
- Lenovo
LnvMSRIO.sysSample 4 · HVCI unknown
- MD5
d60fcf12d1c9a95f2033173c06c2083d- SHA1
9d5410a6033c7b3a13c5776ab3ff8160c17bbf20- SHA256
072ca56c765c937358d3e79c9ecd803c40283a0c32fc4c78e08ea1709d7a832f- Imphash
3b2a2be6141c8dd9d480fe7ab5ede02b- Authentihash MD5
73d16ca31daf80e98727c70566922f64- Authentihash SHA1
3c202f71a39adcd6c32a1037fc65cbf04b6dc129- Authentihash SHA256
cf59e0a6588061ca6851ca766d582c9f6d2138d561d67d265cd6bcdafc99449c- Machine
- AMD64
- Version
- 3.0.2.60
- Publisher
- Lenovo
LnvMSRIO.sysSample 5 · HVCI unknown
- MD5
41b61cad40d1593fae3a9b61257c55b0- SHA1
2511d969c12d56b5d84413af07514d9a0e33c9b9- SHA256
348e7fc97dd20b3db056e3971020da107aa6e82d99be9f04c2d2170f8f39cd58- Imphash
3b2a2be6141c8dd9d480fe7ab5ede02b- Authentihash MD5
3578b299945dc29364a7360079abf367- Authentihash SHA1
f76d6349f0f0caf98e5c317c25d637aa0a54da29- Authentihash SHA256
bee39425ef2cdda84634519f0b5ed8fd509d62ba88e4484ccd436f2b4b5aef7b- Machine
- AMD64
- Version
- 3.0.2.46
- Publisher
- Lenovo
LnvMSRIO.sysSample 6 · HVCI unknown
- MD5
48c61e32e034b15c5bbae481d7559272- SHA1
0284be084b250a01fc01fdc8d3158ea055ee3bdf- SHA256
358b54bdda20c7459d29857fb815548c00751ef486eed90e3f2e835b0bb42cc4- Imphash
3b2a2be6141c8dd9d480fe7ab5ede02b- Authentihash MD5
1fc72d1b5cf27bfd8028efec7309199c- Authentihash SHA1
f353f74dcb91f6ca58f09df76977b6f2781b1d8b- Authentihash SHA256
51a3ab7dd44be6daba53b64c3688b5c1c94c9e2ce1065184fe16cac0d97a0fdc- Machine
- AMD64
- Version
- 3.0.2.28
- Publisher
- Lenovo
LnvMSRIO.sysSample 7 · HVCI unknown
- MD5
936835d0e5e7c0273c06bf2cdcaaa0e9- SHA1
269cc0f1c5222d5147af0dd77102699cbcb5699d- SHA256
9eee4b43ee454fae44e661265de3025561a59060e8969aaeecce79784794ca4d- Imphash
3b2a2be6141c8dd9d480fe7ab5ede02b- Authentihash MD5
61435a86b2a1051ceebdbc0ae367fc68- Authentihash SHA1
9fd899318967abfd5fc29cb67b7c0fa7d30ab8bc- Authentihash SHA256
2da75d8894499204c6cbec258fb1a37668bd80d9007253c2c2fa8599a11d9631- Machine
- AMD64
- Version
- 3.0.2.70
- Publisher
- Lenovo
LnvMSRIO.sysSample 8 · HVCI unknown
- MD5
1a2093b0ca0537ecba6d2c83f2d0e6b7- SHA1
0f2b82c1ce7c82a542d8d781d596bfaaac9b219a- SHA256
b529b658315577e49b9432ec046263a7feca2d3440aea295937350bc974098c4- Imphash
3b2a2be6141c8dd9d480fe7ab5ede02b- Authentihash MD5
0eabdf928219d2fc5f0fc2a666b12a78- Authentihash SHA1
5762d45f34906d1a357d9cbcc9011229721bf660- Authentihash SHA256
ece308c404c03159df71524bcdf1cc2c8746aa41a773e3584d8fa9ff21d8b763- Machine
- AMD64
- Version
- 3.0.2.34
- Publisher
- Lenovo
LnvMSRIO.sysSample 9 · HVCI unknown
- MD5
2bc59df4371b1d1bdcdaa2f4dc119f69- SHA1
339da25d115d67b65d2017139856277a86ed2f17- SHA256
e76638b04f49ce7b01ed2b6ef66b2ac0e6a02643f8513344b71dfcb4aea13c79- Imphash
3b2a2be6141c8dd9d480fe7ab5ede02b- Authentihash MD5
49e73215de1327d237b747fede4767c2- Authentihash SHA1
afe485ab4748d1146ad8a9292c7d9a8f40368e67- Authentihash SHA256
cf8a7fd4ab9e2dadd9c244f01ea10fbc21f6fccd8c03d10c334daad48efa957b- Machine
- AMD64
- Version
- 3.0.2.45
- Publisher
- Lenovo
LnvMSRIO.sysSample 10 · HVCI unknown
- MD5
6352e0b787085eac256c1a8ea41322b7- SHA1
a3a6c2a38f919f3c5d3fa861ff59a6fc40016ffb- SHA256
ec18a0839ff1354dce451926d573e72ce4b2a78782cfceb5b0084e90e77f3220- Imphash
3b2a2be6141c8dd9d480fe7ab5ede02b- Authentihash MD5
3578b299945dc29364a7360079abf367- Authentihash SHA1
f76d6349f0f0caf98e5c317c25d637aa0a54da29- Authentihash SHA256
bee39425ef2cdda84634519f0b5ed8fd509d62ba88e4484ccd436f2b4b5aef7b- Machine
- AMD64
- Version
- 3.0.2.46
- Publisher
- Lenovo
Recorded command
sc.exe create LnvMSRIO binPath=C:\windows\temp\LnvMSRIO.sys type=kernel && sc.exe start LnvMSRIOElevate privileges · Privileges: User · OS: Windows 10, Windows 11
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/409
- https://github.com/fluffycats31/vulnerable-drivers
- https://github.com/magicsword-io/LOLDrivers/issues/242
- https://github.com/symeonp/Lenovo-CVE-2025-8061
- https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-8061
- https://support.lenovo.com/us/en/product_security/LEN-200860
- https://github.com/segura2010/lenovo-dispatcher-poc
- https://github.com/spawn451/CVE-2025-8061-Exploit
- https://any.run/cybersecurity-blog/ironchain-analysis/
Acknowledgement: nasbench, fluffycats31 @nasbench, @fluffycats31