CVE-2024-55413
Published: 07 January 2025
Description
A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
Security Summary
CVE-2024-55413 is a vulnerability in the snxppamd.sys driver included in the SUNIX Parallel Driver x64 version 10.1.0.0. It enables low-privileged users to read and write arbitrary I/O ports via specially crafted IOCTL requests. This issue, published on 2025-01-07 and associated with CWE-787, carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability to achieve privilege escalation, execute code under high privileges, and disclose sensitive information. The driver, being signed, can also bypass Microsoft's driver-signing policy, facilitating the deployment of malicious code.
Details on the vulnerability, including the affected driver, are documented in a GitHub repository at https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55413/CVE-2024-55413_snxppamd.sys_README.md, with the vendor site available at https://www.sunix.com/tw/. No specific mitigation or patch details are outlined in the provided references.
Details
- CWE(s)