c67ad48b-223e-40f8-bfc7-0cb904d0a3d7

pskmad_64.sys :inline

Description

Panda Kernel Memory Access Driver versions through 1.1.0.21 are affected by CVE-2023-6330, CVE-2023-6331, and CVE-2023-6332. This signed 1.0.0.17 build exposes the \Device\PSMEMDriver interface and handles IOCTL 0xB3702C08, which can trigger an out-of-bounds write or disclose arbitrary kernel memory because request data and memory ranges are not adequately validated. The flaws can cause a system crash, leak sensitive kernel data, and may support kernel code execution when chained with another weakness.

  • UUID: c67ad48b-223e-40f8-bfc7-0cb904d0a3d7
  • Created: 2026-08-31
  • Author: Michael Haag
  • Acknowledgement: fluffycats31 | @fluffycats31

Download

This download link contains the vulnerable driver!

Block pskmad_64.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create PSKMAD type= kernel binPath= C:\\windows\\temp\\pskmad_64.sys && sc.exe start PSKMAD
Use CasePrivilegesOperating System
Read kernel memory and corrupt non-paged kernel memoryAdministratorWindows

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://github.com/magicsword-io/LOLDrivers/issues/409
  • https://github.com/fluffycats31/vulnerable-drivers
  • https://www.sophos.com/en-us/blog/multiple-vulnerabilities-discovered-in-widely-used-security-driver
  • https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00001
  • https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00002
  • https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00003

    • Known Vulnerable Samples

    PropertyValue
    Filenamepskmad_64.sys
    Creation Timestamp2016-08-08 02:59:58
    MD59746d407113028f9cdac7031d717203e
    SHA1c582269f43c2d4e1894ff53116bccb9f4abc5acc
    SHA2567f9a397038732678c52a73e5e2238ab3619e3c1fcb2ce41efc8e5bd38d77f83e
    Authentihash MD57ff742e9f4770bf2edec876f4bd3042a
    Authentihash SHA1f3872dc5b28aaad25b16712ed0adb79eafcaf4bc
    Authentihash SHA256cf92fa9fb3067b134f3ae49b981c19bb785e90c8d6348e76f346aa12afc211dc
    RichPEHeaderHash MD5ef3d067a6fc8aaf14d02b0d9f1cc15e3
    RichPEHeaderHash SHA112994df17aa0c486650d12b437c6a69445ee5580
    RichPEHeaderHash SHA256b682b41b221846f76894542c1ed0d433443707c3b99ad2afaa2ba95b87abefee
    CompanyPanda Security, S.L.
    DescriptionPanda Kernel Memory Access Driver (x64)
    ProductPanda Technologies
    OriginalFilenamePSKMAD_64

    Download

    Certificates

    Expand
    Certificate 04000000000125071df9af
    FieldValue
    ToBeSigned (TBS) MD5f47739306d14722e670d9436eadb8e4f
    ToBeSigned (TBS) SHA1457d9df00a652cb4c3356d00145d9528fc309172
    ToBeSigned (TBS) SHA256bd1765c56594221373893ef26d97f88c144fb0e5a0111215b45d7239c3444df7
    SubjectOU=GlobalSign Root CA , R3, O=GlobalSign, CN=GlobalSign
    ValidFrom2009-11-18 10:00:00
    ValidTo2019-03-18 10:00:00
    Signature4252a97ea2cf5b3bcb4bddbaf85759d324a47772ef62443782ed06ee04d5165f24a314dc6c54056ab09b3dda8139daad28db956f8183f5cd62b14524b1dd29e5085495958cf01d065f1ad6463f1340174811169b474dd13ab50f571c9230d0f8b2253b0acdf687f9c7b257d33f7da58c14ce9ca8c79f4693da59fa795d652035445a4fc1909dc1549256dc34c8f5c103d05dc059489c00fc95a0f1d176f71636c813927f2d2bc0b880f126261f414d52bf1e97bb018208e715f6c1d5342accf5e4c3877a5781e1d6d74286620177e2a9c47a86f404387a076a7d00ec73f7a80b3478c59eb3efb838400e8c3353c875ec5f3eea755eff820e7415dc1905f3ba31
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber04000000000125071df9af
    Version3
    Certificate 0400000000013189c64de1
    FieldValue
    ToBeSigned (TBS) MD5b3d3ff804abcd2e7686c126c98cc2c10
    ToBeSigned (TBS) SHA1358391557c2b6213777e282ad8efe9c8112d1b0e
    ToBeSigned (TBS) SHA2569467b8e0d2879abe9a9b791d7a1aa60672949af71bb1b2a5aca1a54368519bca
    SubjectC=BE, O=GlobalSign nv,sa, CN=GlobalSign Extended Validation CodeSigning CA , SHA256 , G2
    ValidFrom2011-08-02 10:00:00
    ValidTo2019-08-02 10:00:00
    Signatureaaa11197ffb423e8f303ecd38eef52a15c833563e5fff142b78335c693f5505e9b8921e85853188834fbdd49e122ea0f8ab122482919dc2ef92368588114552d24b929687853ac72fdcbf18a53a0dac8106f8938236ebb99f17390dbf1bf80a3ae8d4915bc8d88fd591dfe13ae54c3a697cd006b3d4148901505e4a41803d4d7a9e3a940b66c21acd37e1ce65df404b18bda0cd8aaebb936517f173a8d3728c7b7b8719012c66c6cb4843bf1a547dcc4a33b2c5dea0883c4e33910e4ab21650a4256d8b268f693e51ee28301ab0b86b2cfa54a37a4b2dc6cd782318d3f90e6b12a057089fc201d9f2af7ccdd93b5570deb400302d0044f84edf0728007951214
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber0400000000013189c64de1
    Version3
    Certificate 6129152700000000002a
    FieldValue
    ToBeSigned (TBS) MD50bb058d116f02817737920f112d9fd3b
    ToBeSigned (TBS) SHA1fd116235171a4feafedee586b7a59185fb5fd7e6
    ToBeSigned (TBS) SHA256f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4
    SubjectC=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA
    ValidFrom2011-04-15 19:55:08
    ValidTo2021-04-15 20:05:08
    Signature5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber6129152700000000002a
    Version3
    Certificate 11219873654df7d712c9fe7c2d374eefa7ab
    FieldValue
    ToBeSigned (TBS) MD59d408b0c2e5a1520b0508a7b242c0a5d
    ToBeSigned (TBS) SHA1a4c64020ee78bca379a16e301b527ff47862ee81
    ToBeSigned (TBS) SHA2566db0a5c906b450bac556c9512a9db7fd1c81f25f356fc2e60878f1696a3a228e
    SubjectBUSINESS_CATEGORY=Private Organization, serialNumber=B48435218, JURISDICTION_OF_INCORPORATION_C=ES, C=ES, ST=Bizkaia, L=Bilbao, STREET_ADDRESS=Gran Via, 4, O=Panda Security S.L., CN=Panda Security S.L.
    ValidFrom2015-11-27 15:16:51
    ValidTo2016-11-27 15:16:51
    Signature24033718d311a4cea3c6e9a256c264aecfc23d77aff55cd9c014673f5b9f4c16fd70bc0b69b6d3cdddcc308555100388304501486e58507299280efd1a6c6f736af0b2f3f916f69180dc65314298b15696256d70520b593339d39e5829f18bb3eca5b35e0e1a52bfc3f6bd4fd2e4471b7d9c9aca9e2fd3a249cc0959e19632cf3b3369ad7363ffd496653d437dad7e9ae654d4ebc7b994a0340cf28786ea1af5917a29b5532a270c485569e9f66bc32813c688dbdd45def3693d86e4302ea498c4288a92f71724889f05393cdda3cbeb04fcfb56131a1a8e59419fa86da54e3e9045ee42921e0de0696b4bc8d73f3af4f03ff2a82f39c697d3923f53db693020
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber11219873654df7d712c9fe7c2d374eefa7ab
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • ExAllocatePoolWithTag
    • IoWMIRegistrationControl
    • ExFreePoolWithTag
    • IoWMIWriteEvent
    • RtlInitUnicodeString
    • MmGetSystemRoutineAddress
    • IoGetCurrentProcess
    • IofCompleteRequest
    • RtlCompareMemory
    • sprintf
    • ZwCreateKey
    • ExInitializeNPagedLookasideList
    • IoDeleteDevice
    • RtlGetVersion
    • ZwQueryValueKey
    • ZwClose
    • RtlCharToInteger
    • IoCreateSymbolicLink
    • wcscspn
    • ExDeleteNPagedLookasideList
    • MmSystemRangeStart
    • MmUnmapLockedPages
    • PsProcessType
    • KeSetTargetProcessorDpc
    • KeQueryActiveProcessors
    • ZwFsControlFile
    • PsLookupProcessByProcessId
    • InitializeSListHead
    • ZwQuerySymbolicLinkObject
    • ZwSetEaFile
    • ZwReadFile
    • ZwMapViewOfSection
    • ExpInterlockedPushEntrySList
    • IoCreateFile
    • MmHighestUserAddress
    • KeInitializeDpc
    • KeAcquireQueuedSpinLock
    • ExpInterlockedPopEntrySList
    • KeReleaseQueuedSpinLock
    • MmUnmapIoSpace
    • MmBuildMdlForNonPagedPool
    • ZwOpenSymbolicLinkObject
    • IoFreeMdl
    • ZwSetInformationFile
    • KeDetachProcess
    • KeDelayExecutionThread
    • MmGetPhysicalAddress
    • ZwWaitForSingleObject
    • PsCreateSystemThread
    • MmMapLockedPagesSpecifyCache
    • ZwUnmapViewOfSection
    • ZwQueryDirectoryFile
    • PsTerminateSystemThread
    • MmIsDriverVerifying
    • MmMapIoSpace
    • KeInsertQueueDpc
    • ZwQueryEaFile
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByHandle
    • MmProbeAndLockPages
    • KeRevertToUserAffinityThread
    • RtlEnumerateGenericTableAvl
    • MmUnlockPages
    • PsGetCurrentProcessId
    • KeSetSystemAffinityThread
    • MmIsAddressValid
    • ObfDereferenceObject
    • ZwCreateSection
    • KeNumberProcessors
    • ZwQueryInformationFile
    • ZwWriteFile
    • ObReferenceObjectByPointer
    • ObOpenObjectByPointer
    • KeStackAttachProcess
    • IoAllocateMdl
    • ZwQuerySystemInformation
    • KeBugCheckEx
    • IoCreateDevice
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • _snwprintf
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlSetDaclSecurityDescriptor
    • RtlAbsoluteToSelfRelativeSD
    • IoIsWdmVersionAvailable
    • SeExports
    • wcschr
    • _wcsnicmp
    • RtlLengthSid
    • RtlAddAccessAllowedAce
    • RtlGetSaclSecurityDescriptor
    • RtlGetDaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • ZwOpenKey
    • ZwSetValueKey
    • RtlFreeUnicodeString
    • __C_specific_handler

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • PAGE
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "04000000000125071df9af",
      "Signature": "4252a97ea2cf5b3bcb4bddbaf85759d324a47772ef62443782ed06ee04d5165f24a314dc6c54056ab09b3dda8139daad28db956f8183f5cd62b14524b1dd29e5085495958cf01d065f1ad6463f1340174811169b474dd13ab50f571c9230d0f8b2253b0acdf687f9c7b257d33f7da58c14ce9ca8c79f4693da59fa795d652035445a4fc1909dc1549256dc34c8f5c103d05dc059489c00fc95a0f1d176f71636c813927f2d2bc0b880f126261f414d52bf1e97bb018208e715f6c1d5342accf5e4c3877a5781e1d6d74286620177e2a9c47a86f404387a076a7d00ec73f7a80b3478c59eb3efb838400e8c3353c875ec5f3eea755eff820e7415dc1905f3ba31",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "OU=GlobalSign Root CA , R3, O=GlobalSign, CN=GlobalSign",
      "TBS": {
        "MD5": "f47739306d14722e670d9436eadb8e4f",
        "SHA1": "457d9df00a652cb4c3356d00145d9528fc309172",
        "SHA256": "bd1765c56594221373893ef26d97f88c144fb0e5a0111215b45d7239c3444df7",
        "SHA384": "b8b268a1bdf388be66a1c969b7b353cb2bbc9fad446049b7efa05a9ab3b714494e97f4d1ee1c0bae35bfd9bf6ef275b3"
      },
      "ValidFrom": "2009-11-18 10:00:00",
      "ValidTo": "2019-03-18 10:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "0400000000013189c64de1",
      "Signature": "aaa11197ffb423e8f303ecd38eef52a15c833563e5fff142b78335c693f5505e9b8921e85853188834fbdd49e122ea0f8ab122482919dc2ef92368588114552d24b929687853ac72fdcbf18a53a0dac8106f8938236ebb99f17390dbf1bf80a3ae8d4915bc8d88fd591dfe13ae54c3a697cd006b3d4148901505e4a41803d4d7a9e3a940b66c21acd37e1ce65df404b18bda0cd8aaebb936517f173a8d3728c7b7b8719012c66c6cb4843bf1a547dcc4a33b2c5dea0883c4e33910e4ab21650a4256d8b268f693e51ee28301ab0b86b2cfa54a37a4b2dc6cd782318d3f90e6b12a057089fc201d9f2af7ccdd93b5570deb400302d0044f84edf0728007951214",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign Extended Validation CodeSigning CA , SHA256 , G2",
      "TBS": {
        "MD5": "b3d3ff804abcd2e7686c126c98cc2c10",
        "SHA1": "358391557c2b6213777e282ad8efe9c8112d1b0e",
        "SHA256": "9467b8e0d2879abe9a9b791d7a1aa60672949af71bb1b2a5aca1a54368519bca",
        "SHA384": "936a127c2d468f5e4edb642c82bed11fb5df99b87cf34b8d7ddc136e979183d133dae715146d98c63af32186eb8d1bbd"
      },
      "ValidFrom": "2011-08-02 10:00:00",
      "ValidTo": "2019-08-02 10:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "6129152700000000002a",
      "Signature": "5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA",
      "TBS": {
        "MD5": "0bb058d116f02817737920f112d9fd3b",
        "SHA1": "fd116235171a4feafedee586b7a59185fb5fd7e6",
        "SHA256": "f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4",
        "SHA384": "c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"
      },
      "ValidFrom": "2011-04-15 19:55:08",
      "ValidTo": "2021-04-15 20:05:08",
      "Version": 3
    },
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "11219873654df7d712c9fe7c2d374eefa7ab",
      "Signature": "24033718d311a4cea3c6e9a256c264aecfc23d77aff55cd9c014673f5b9f4c16fd70bc0b69b6d3cdddcc308555100388304501486e58507299280efd1a6c6f736af0b2f3f916f69180dc65314298b15696256d70520b593339d39e5829f18bb3eca5b35e0e1a52bfc3f6bd4fd2e4471b7d9c9aca9e2fd3a249cc0959e19632cf3b3369ad7363ffd496653d437dad7e9ae654d4ebc7b994a0340cf28786ea1af5917a29b5532a270c485569e9f66bc32813c688dbdd45def3693d86e4302ea498c4288a92f71724889f05393cdda3cbeb04fcfb56131a1a8e59419fa86da54e3e9045ee42921e0de0696b4bc8d73f3af4f03ff2a82f39c697d3923f53db693020",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "BUSINESS_CATEGORY=Private Organization, serialNumber=B48435218, JURISDICTION_OF_INCORPORATION_C=ES, C=ES, ST=Bizkaia, L=Bilbao, STREET_ADDRESS=Gran Via, 4, O=Panda Security S.L., CN=Panda Security S.L.",
      "TBS": {
        "MD5": "9d408b0c2e5a1520b0508a7b242c0a5d",
        "SHA1": "a4c64020ee78bca379a16e301b527ff47862ee81",
        "SHA256": "6db0a5c906b450bac556c9512a9db7fd1c81f25f356fc2e60878f1696a3a228e",
        "SHA384": "96a2b733af62a8c25756513e6f0234767176a610a44536fb728b9879aeb4dadd79fd9d54b55becc727e7b8d0036e7bac"
      },
      "ValidFrom": "2015-11-27 15:16:51",
      "ValidTo": "2016-11-27 15:16:51",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign Extended Validation CodeSigning CA , SHA256 , G2",
      "SerialNumber": "11219873654df7d712c9fe7c2d374eefa7ab",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-08-31