← Back to driver explorer
Driver intelligenceVulnerableVerified
WibuKey64.sys
WibuKey for Windows releases before 6.70 are affected by CVE-2024-45181 and CVE-2024-45182. Version 6.70 is separately affected by the boundary-validation flaw documented in WIBU-100057 and fixed in 6.71. The tracked 6.40 and 6.50a builds fall in the first affected range. In the tracked 6.70 build, subcommand 0x14 of IOCTL 0x8200E804 combines a caller-controlled offset with an input-buffer pointer without validating that the resulting object remains inside the request, enabling out-of-bounds kernel access.
Known samples 3
0 recorded TRUE · 0 recorded FALSE · 3 unknown for loading despite HVCI. Results apply to individual samples.
WibuKey64.sysSample 1 · HVCI unknown
- MD5
63bcd4467778d02e53cb958afa66e964- SHA1
6e06e8443f9551cfcd9f50370af0ba625a7c540d- SHA256
7ab52ce255f4ee1d192e9a3cc0b836eaea10bd3c2d0d732519eb2f5968617ffd- Imphash
d17078994081d128a915504f53c91bab- Authentihash MD5
7d0dec6c230c6afbef77067120e13edd- Authentihash SHA1
8f86fa38ce8e5dffafe466ed01ac7d5cf77b60b3- Authentihash SHA256
195c81c620c90f2a1579c56bba3fa7effd6cd2e41c350334ad09e5ecc0bc68ce- Machine
- AMD64
- Version
- Version 6.50a of 2019-Jan-08 (Build 3314)
- Publisher
- WIBU-SYSTEMS AG
WibuKey64.sysSample 2 · HVCI unknown
- MD5
392dd03ff1b0d32784407853cb400b2e- SHA1
1b67d6c17a5201979d3276a2e40eaea15168fc5c- SHA256
17cf356d124df2afd44bfd1e26c1bd0dd5c73dc4709525a4d84b481a2e44771b- Imphash
d17078994081d128a915504f53c91bab- Authentihash MD5
43944466d47b177e26a74dbf9a643367- Authentihash SHA1
ed0a176846fb34121d2675f0878baaac601242d6- Authentihash SHA256
0a3b656fe3eaca840eb5225a5f85816b350d1e052b0cb696d1853503a3a1ea03- Machine
- AMD64
- Version
- Version 6.40 of 2016-Dec-14 (Build 2400)
- Publisher
- WIBU-SYSTEMS AG
WibuKey64.sysSample 3 · HVCI unknown
- MD5
682588c4c5a28fcef48be859791c95b6- SHA1
9094cdc8bddb487024379c4ed8438e87b21de930- SHA256
3e74265e10f596a89f2725b1fb19bd7098113d16301208c81b32356b34ee378a- Imphash
2596c98269f53b39773f6dd9df345e33- Authentihash MD5
c2d88a59ff9615ad49f73343544b14de- Authentihash SHA1
7b6e0065fd31fb699b5b3963cbcb70ccf3e8678e- Authentihash SHA256
c1d7ef1165e8ecb5ccd5de4108cd79c88b4d87b4b600f102ecbe2279b242d9e7- Machine
- AMD64
- Version
- Version 6.70 of 2024- Aug- 28(Build 6532)
- Publisher
- WIBU-SYSTEMS AG
Recorded command
sc.exe create WibuKey type= kernel binPath= C:\\windows\\temp\\WibuKey64.sys && sc.exe start WibuKeyRead and corrupt kernel memory · Privileges: User · OS: Windows
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/409
- https://github.com/fluffycats31/vulnerable-drivers
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-94453.pdf
- https://nvd.nist.gov/vuln/detail/CVE-2024-45181
- https://nvd.nist.gov/vuln/detail/CVE-2024-45182
- https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100057.pdf
Acknowledgement: fluffycats31 @fluffycats31