CVE-2023-1677
📋 TL;DR
A local denial-of-service vulnerability exists in DriverGenius 9.70.0.346's kernel driver mydrivers64.sys. Attackers can trigger a system crash by sending specially crafted IOCTL requests to vulnerable driver functions. Only users running the affected version of DriverGenius on Windows systems are impacted.
💻 Affected Systems
- DriverGenius
📦 What is this software?
Drivergenius by Drivergenius
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash/BSOD requiring reboot, potentially causing data loss or service disruption.
Likely Case
Local denial-of-service causing system instability or crash, requiring reboot to restore functionality.
If Mitigated
Minimal impact if driver is not loaded or vulnerable functions are not accessible.
🎯 Exploit Status
Exploit code is publicly available on GitHub, requiring local execution privileges to trigger the vulnerable IOCTL handlers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check for DriverGenius updates from official sources. 2. If no patch is available, consider uninstalling DriverGenius 9.70.0.346. 3. Restart system after uninstallation.
🔧 Temporary Workarounds
Uninstall DriverGenius
windowsRemove the vulnerable software to eliminate the attack surface.
Control Panel > Programs > Uninstall a program > Select DriverGenius > Uninstall
Disable DriverGenius Service
windowsPrevent the vulnerable driver from loading at system startup.
sc stop DriverGeniusService
sc config DriverGeniusService start= disabled
🧯 If You Can't Patch
- Restrict local user privileges to prevent execution of exploit code.
- Implement application whitelisting to block unauthorized executables.
🔍 How to Verify
Check if Vulnerable:
Check if DriverGenius 9.70.0.346 is installed via Programs and Features or run: wmic product get name,version | findstr DriverGeniusCheck Version:
wmic product where "name like '%DriverGenius%'" get versionVerify Fix Applied:
Verify DriverGenius is uninstalled or updated to a newer version, and mydrivers64.sys driver is not loaded in kernel.📡 Detection & Monitoring
Log Indicators:
- System event logs showing unexpected system crashes/BSODs
- Security logs showing process creation of exploit tools
Network Indicators:
- Local IOCTL calls to vulnerable driver functions (not typically network visible)
SIEM Query:
EventID=41 OR (ProcessName contains 'exploit' AND ParentProcess contains 'DriverGenius')🔗 References
- https://drive.google.com/file/d/1C7afiLbOOLuYZVeeslPW3AdNeOIwUea9/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1677
- https://vuldb.com/?ctiid.224234
- https://vuldb.com/?id.224234
- https://drive.google.com/file/d/1C7afiLbOOLuYZVeeslPW3AdNeOIwUea9/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1677
- https://vuldb.com/?ctiid.224234
- https://vuldb.com/?id.224234
