CVE-2023-1679
📋 TL;DR
This is a critical local privilege escalation vulnerability in DriverGenius software. The vulnerability allows attackers with local access to exploit a memory corruption flaw in the kernel driver to execute arbitrary code with SYSTEM privileges. Only users of DriverGenius version 9.70.0.346 are affected.
💻 Affected Systems
- DriverGenius
📦 What is this software?
Drivergenius by Drivergenius
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing installation of persistent malware, credential theft, and lateral movement across the network.
Likely Case
Local privilege escalation from standard user to SYSTEM privileges, enabling attackers to bypass security controls and install additional payloads.
If Mitigated
Limited impact if proper endpoint protection and least privilege principles are enforced, though local attackers could still gain elevated privileges.
🎯 Exploit Status
Exploit code is publicly available on GitHub and requires local access to execute. The vulnerability is in a kernel driver, making exploitation more complex than user-space vulnerabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider uninstalling DriverGenius 9.70.0.346 until a fixed version is released.
🔧 Temporary Workarounds
Uninstall DriverGenius
windowsRemove the vulnerable software to eliminate the attack surface
Control Panel > Programs > Uninstall a program > Select DriverGenius > Uninstall
Block vulnerable driver loading
windowsUse Windows Defender Application Control or similar to block mydrivers64.sys
🧯 If You Can't Patch
- Implement strict least privilege principles to limit damage from privilege escalation
- Deploy endpoint detection and response (EDR) solutions to detect exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if DriverGenius version 9.70.0.346 is installed via Programs and Features or by checking the installed software versionCheck Version:
wmic product where name="DriverGenius" get versionVerify Fix Applied:
Verify DriverGenius is uninstalled or updated to a version later than 9.70.0.346📡 Detection & Monitoring
Log Indicators:
- Driver load events for mydrivers64.sys
- Process creation with elevated privileges from DriverGenius processes
Network Indicators:
- No network indicators as this is a local vulnerability
SIEM Query:
EventID=7045 AND ServiceName="mydrivers64.sys" OR ProcessName="DriverGenius.exe" AND NewProcessName="cmd.exe" OR "powershell.exe"🔗 References
- https://drive.google.com/file/d/1Iz4VTUUVDveZlgtxN9WkvdygHkD1BUCr/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1679
- https://vuldb.com/?ctiid.224236
- https://vuldb.com/?id.224236
- https://drive.google.com/file/d/1Iz4VTUUVDveZlgtxN9WkvdygHkD1BUCr/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1679
- https://vuldb.com/?ctiid.224236
- https://vuldb.com/?id.224236
