← Back to driver explorer
Driver intelligenceVulnerableVerified
AMDPowerProfiler.sys
AMD uProf AMDPowerProfiler.sys is affected by CVE-2021-26334. Insufficient access control permits lower-privileged callers to access model-specific registers, which can lead to privilege escalation and ring-0 code execution. AMD addresses the issue in the Windows uProf 3.4.494 release.
Known samples 3
0 recorded TRUE · 2 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
AMDPowerProfiler.sysSample 1 · HVCI unknown
- MD5
a39771e8edd0e947aa92e1fef441c5f1- SHA1
fb64b28842c2043214d7f1773cba3d9d5484f77f- SHA256
5f7bf4e385cd44014f389058411374172ecd79d9066abcbbbc59dd84f89b85fb- Imphash
dc46830dae0b3da4d2889bb5d44a3f85- Authentihash MD5
ea95cd42c9d64f2bea50518a131c3bdb- Authentihash SHA1
b3a12e2cbb5aab2259229c74183eb29d937dda01- Authentihash SHA256
28eca097fd81f4746777518ad1abe19fd5b4c7a27ca03e554148cf7caceb4013- Machine
- AMD64
- Version
- 6.0.0.0
- Publisher
- Advanced Micro Devices, Inc.
AMDPowerProfiler.sysSample 2 · HVCI FALSE
- MD5
e4266262a77fffdea2584283f6c4f51d- SHA1
b480c54391a2a2f917a44f91a5e9e4590648b332- SHA256
0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05- Imphash
1422b8d354b95d9cd880c8726df45dfc- Authentihash MD5
7ed9c787e267b2606441010b65767771- Authentihash SHA1
07a5aac8abb0a85822bf792607b9e90914b454dc- Authentihash SHA256
e1d3963c55c7ffa96d16e47ec4bbb4e171f828650ce853eb0b83c90ae9c6265a- Machine
- AMD64
- Version
- 6.1.0.0
- Publisher
- Advanced Micro Devices, Inc.
AMDPowerProfiler.sysSample 3 · HVCI FALSE
- MD5
e70ab7b9b9929ffd730556555045f3c6- SHA1
ca7c1ef1c832149315c8ca349cb1ae1387021c4b- SHA256
1e6f08a686be2e28469b2d71d8567f2023ddbd65bd65618fc7bbac16d39e04d5- Imphash
dc46830dae0b3da4d2889bb5d44a3f85- Authentihash MD5
a7cb389d261dc8ee419a95a49515e8a2- Authentihash SHA1
9cdc47be68320edf0e131b88dcf0130bcebcdd45- Authentihash SHA256
760e04785b220ef3b141e414b9f3d6cbfeaf1a113e0ec697660ddf06b00c4405- Machine
- AMD64
- Version
- 6.0.0.0
- Publisher
- Advanced Micro Devices, Inc.
Recorded command
sc.exe create AMDPowerProfiler.sys binPath=C:\windows\temp\AMDPowerProfiler.sys type=kernel && sc.exe start AMDPowerProfiler.sysElevate privileges · Privileges: User · OS: Windows 10
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/409 ↗
- https://github.com/elastic/protections-artifacts/search?q=VulnDriver ↗
- https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1016.html ↗
- https://nvd.nist.gov/vuln/detail/CVE-2021-26334 ↗
- https://github.com/fluffycats31/vulnerable-drivers ↗
Acknowledgement: fluffycats31 @fluffycats31