LOLDriversTHE DRIVER THREAT CATALOG
← Back to driver explorer
Driver intelligenceVulnerableVerified

pskmad_64.sys

Panda Kernel Memory Access Driver versions through 1.1.0.21 are affected by CVE-2023-6330, CVE-2023-6331, and CVE-2023-6332. The tracked 1.0.0.16 and 1.0.0.17 builds expose IOCTL 0xB3702C08 through \Device\PSMEMDriver. After a fixed magic value, the request accepts a process, address, and caller-controlled length without relating that length to the fixed buffered-I/O header, allowing kernel-memory disclosure and buffered-output corruption.

UUID / c67ad48b-223e-40f8-bfc7-0cb904d0a3d7ADDED / 2026-08-31AUTHOR / Michael Haag

Known samples 2

0 recorded TRUE · 0 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.

pskmad_64.sysSample 1 · HVCI unknown
MD5
9746d407113028f9cdac7031d717203e
SHA1
c582269f43c2d4e1894ff53116bccb9f4abc5acc
SHA256
7f9a397038732678c52a73e5e2238ab3619e3c1fcb2ce41efc8e5bd38d77f83e
Imphash
4cc218740b780c7d3e40804b184c2b5d
Authentihash MD5
7ff742e9f4770bf2edec876f4bd3042a
Authentihash SHA1
f3872dc5b28aaad25b16712ed0adb79eafcaf4bc
Authentihash SHA256
cf92fa9fb3067b134f3ae49b981c19bb785e90c8d6348e76f346aa12afc211dc
Machine
AMD64
Version
1.0.0.17
Publisher
Panda Security, S.L.
Download vulnerable sampleView on VirusTotal
PSKMAD_64.sysSample 2 · HVCI unknown
MD5
f803473cd0e5d36d02eb58109f1294cd
SHA1
afa8295865d8a9b1d35522bf2e49ced6f2294f4f
SHA256
db6ffb4100bd35d491ff1c61fb3073049c2c18038d004a6d1e279a95ab8ba2ec
Imphash
4cc218740b780c7d3e40804b184c2b5d
Authentihash MD5
96e50bd954df7b979be7da555fcb1941
Authentihash SHA1
bc2a5e5347cc2e9bc09bf269da5bf7ca1cd8bc15
Authentihash SHA256
897b1107e11dab0029bd31582a84a08e70e0f98aff3179b86cc5a0fabcec95b6
Machine
AMD64
Version
1.0.0.16
Publisher
Panda Security, S.L.
Download vulnerable sampleView on VirusTotal

Recorded command

sc.exe create PSKMAD type= kernel binPath= C:\\windows\\temp\\pskmad_64.sys && sc.exe start PSKMAD

Read kernel memory and corrupt non-paged kernel memory · Privileges: Administrator · OS: Windows

Research & references

Acknowledgement: fluffycats31 @fluffycats31