CVE-2024-12656
📋 TL;DR
This vulnerability is a null pointer dereference in FabulaTech USB over Network Client's ftusbbus2.sys driver, specifically in the IOCTL handler function 0x220448. It allows local attackers to cause a denial-of-service (system crash/BSOD) by sending specially crafted IOCTL requests. Only users of FabulaTech USB over Network Client version 6.0.6.1 are affected.
💻 Affected Systems
- FabulaTech USB over Network Client
📦 What is this software?
Usb Over Network by Fabulatech
⚠️ Risk & Real-World Impact
Worst Case
Local attacker causes kernel panic/BSOD leading to system downtime and potential data loss from unsaved work.
Likely Case
Local user or malware causes system crash requiring reboot, disrupting USB over Network functionality.
If Mitigated
With proper access controls, only authorized users could trigger the crash, limiting exposure.
🎯 Exploit Status
Exploit code has been publicly disclosed. Attack requires local execution privileges to send IOCTL to driver.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider workarounds or alternative software.
🔧 Temporary Workarounds
Restrict driver access
windowsModify driver permissions to prevent non-admin users from sending IOCTL requests
icacls "C:\Windows\System32\drivers\ftusbbus2.sys" /deny Users:(R,X)
Requires administrative privileges and may break functionality for standard users
Disable or uninstall USB over Network Client
windowsRemove vulnerable component if not essential
Uninstall via Control Panel > Programs and Features
sc stop "USB over Network Service"
sc delete "USB over Network Service"
🧯 If You Can't Patch
- Implement strict local access controls to limit who can execute code on affected systems
- Monitor for crash dumps or system events related to ftusbbus2.sys driver failures
🔍 How to Verify
Check if Vulnerable:
Check if ftusbbus2.sys driver version 6.0.6.1 is present in C:\Windows\System32\drivers\Check Version:
powershell Get-Item "C:\Windows\System32\drivers\ftusbbus2.sys" | Select-Object VersionInfoVerify Fix Applied:
Verify driver version has changed from 6.0.6.1 or driver has been removed📡 Detection & Monitoring
Log Indicators:
- Windows Event Log System crashes with BugCheck codes
- Application logs showing USB over Network service failures
Network Indicators:
- None - local exploit only
SIEM Query:
EventID=41 OR Source="USB over Network" OR ProcessName="ftusbbus2.sys"