← Back to driver explorer
Driver intelligenceVulnerableVerified
fekern.sys
Trellix HX Agent fekern.sys 34.x is affected by CVE-2025-14963. The signed FireEye 34.5.0 and 34.8.0 builds tracked here expose the \\Device\\fekern_00 interface. Used as a standalone BYOVD, the vulnerable driver can provide access to LSASS memory and enable local privilege escalation. A fully functioning HX Agent restricts access through tamper protection.
Known samples 2
0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
fekern.sysSample 1 · HVCI unknown
- MD5
ecc5833db5e979c27d10505e01e6859a- SHA1
e50d565f5fc871bb861423a9ceaf970305f3959e- SHA256
d5b353dc323c12f4a6f85842a3d2c0a27e0288177ca0e0a051754b9ae4c6fcc9- Imphash
8ec2c090a23007b8e80ed4b55a216183- Authentihash MD5
7aa7043fd75844450f0d42ae71b7712c- Authentihash SHA1
b9c99f9a08f86ac19424a62dc9dd8a5d2e41fd1b- Authentihash SHA256
e410d3084e4d52c6c51e84b2ed710b5f7695da749e7f54232f5093953f67ec77- Machine
- AMD64
- Version
- 34.5.0
- Publisher
- FireEye, Inc.
fekern.sysSample 2 · HVCI unknown
- MD5
7e3a84e0684abf96af51607db10c3e18- SHA1
6ffd13225c3c2b8bc20dc662ae8b53751826bd3c- SHA256
16f68c6e527aacd803cb2412766f00766527e1c880ed8da50bfedac501918320- Imphash
8ec2c090a23007b8e80ed4b55a216183- Authentihash MD5
43c61edd0eb2beb7531ba22f636e57a6- Authentihash SHA1
137fb5e1606537867037cab001742ff943f03476- Authentihash SHA256
33ca5d851b35c1f957f1f688d5a47156be58bc00162dbed5b2a0ff85d4b8bc22- Machine
- AMD64
- Version
- 34.8.0
- Publisher
- FireEye, Inc.
Recorded command
sc.exe create fekern type= kernel binPath= C:\\windows\\temp\\fekern.sys && sc.exe start fekernAccess protected process memory and elevate privileges · Privileges: Administrator · OS: Windows
Research & references
Acknowledgement: fluffycats31 @fluffycats31