CVE-2024-45181
📋 TL;DR
This vulnerability in WibuKey64.sys driver allows attackers to send specially crafted packets that bypass bounds checking, leading to arbitrary address writes and kernel memory corruption. It affects all systems running WIBU-SYSTEMS WibuKey software versions before 6.70. This could enable local privilege escalation or system compromise.
💻 Affected Systems
- WIBU-SYSTEMS WibuKey
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via kernel privilege escalation leading to full administrative control, data theft, or persistent backdoor installation.
Likely Case
Local privilege escalation allowing attackers to gain SYSTEM/root privileges from a lower-privileged account.
If Mitigated
Limited impact if proper access controls prevent local user access or if vulnerable driver is not loaded.
🎯 Exploit Status
Requires local access and knowledge of driver communication. Kernel exploitation requires careful memory manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.70
Vendor Advisory: https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-94453.pdf
Restart Required: Yes
Instructions:
1. Download WibuKey version 6.70 or later from wibu.com. 2. Install the update following vendor instructions. 3. Restart the system to load the patched driver.
🔧 Temporary Workarounds
Disable WibuKey driver
windowsTemporarily disable the vulnerable driver if WibuKey functionality is not required
sc stop WibuKey64
sc config WibuKey64 start= disabled
Restrict driver access
windowsApply strict ACLs to limit which users can interact with the driver
icacls "C:\Windows\System32\drivers\WibuKey64.sys" /deny Users:(R,X)
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to systems running WibuKey
- Monitor for suspicious driver interactions and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check WibuKey version in installed programs or driver version via 'driverquery /v | findstr WibuKey64'Check Version:
driverquery /v | findstr WibuKey64Verify Fix Applied:
Verify WibuKey version is 6.70 or higher and driver date is after patch release📡 Detection & Monitoring
Log Indicators:
- Driver load events for WibuKey64.sys
- Privilege escalation attempts
- Unusual process creation from driver-related processes
Network Indicators:
- Local inter-process communication with WibuKey driver
SIEM Query:
EventID=7045 AND ServiceName="WibuKey64" OR ProcessName="WibuKey64.sys" AND EventID=4688