CVE-2023-31096
📋 TL;DR
This vulnerability allows local attackers to escalate privileges from medium-integrity processes to SYSTEM via a stack overflow in the Broadcom LSI PCI-SV92EX Soft Modem Kernel Driver. It affects systems running the vulnerable driver version 2.2.100.1 or earlier. Attackers can use this to bypass security protections like antivirus or PPL (Protected Process Light) in coordinated ransomware campaigns.
💻 Affected Systems
- Broadcom LSI PCI-SV92EX Soft Modem Kernel Driver (AGRSM64.sys)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full SYSTEM compromise enabling ransomware deployment, data exfiltration, persistence establishment, and complete system control bypassing all kernel-level protections.
Likely Case
Local privilege escalation used in targeted attacks to gain SYSTEM privileges for credential dumping, lateral movement, or disabling security software.
If Mitigated
Limited impact with proper driver blocklisting, least privilege enforcement, and security monitoring detecting privilege escalation attempts.
🎯 Exploit Status
Exploit requires local access and medium integrity privileges first. The vulnerability is well-documented with technical analysis available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.broadcom.com
Restart Required: No
Instructions:
Check Broadcom website for updated driver. If unavailable, remove or disable the vulnerable driver using driver blocklisting.
🔧 Temporary Workarounds
Driver Blocklisting
windowsPrevent loading of the vulnerable driver using Windows Driver Block Rules
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Driver Security" /v "DriverBlockRules" /t REG_SZ /d "AGRSM64.sys" /f
Driver Removal
windowsUninstall the Broadcom LSI PCI-SV92EX Soft Modem driver if not needed
pnputil /remove-device "PCI\VEN_14E4&DEV_16B5&SUBSYS_16B514E4"
🧯 If You Can't Patch
- Implement strict least privilege principles to limit initial access opportunities
- Deploy endpoint detection and response (EDR) solutions to detect privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check driver version: Open Device Manager > Modems > Broadcom LSI PCI-SV92EX Soft Modem > Driver tab. Version should be higher than 2.2.100.1.Check Version:
powershell Get-WmiObject Win32_PnPSignedDriver | Where-Object {$_.DeviceName -like '*PCI-SV92EX*'} | Select-Object DeviceName, DriverVersionVerify Fix Applied:
Verify driver is not loaded: Run 'sc query AGRSM64' or check Device Manager that driver is not present.📡 Detection & Monitoring
Log Indicators:
- Event ID 7045: Service installation for AGRSM64
- Driver load events for AGRSM64.sys
- Privilege escalation attempts from medium to SYSTEM integrity
Network Indicators:
- Unusual outbound connections following local privilege escalation
SIEM Query:
source="*security*" (EventCode=4672 OR EventCode=4688) AND (NewIntegrityLevel="System" OR SubjectIntegrityLevel="Medium") AND ProcessName="*"