CVE-2025-11156

Executive Summary

CVE-2025-11156 describes a local denial-of-service vulnerability in the Netskope NS Client agent on Windows systems. A local authenticated user with Administrator privileges can improperly load the driver as a generic kernel service, triggering a system crash (Blue Screen of Death). This flaw does not require network access but does require high privileges, limiting the attack surface to already-compromised or malicious insiders. No public exploit code or proof-of-concept is available at this time, and the vendor has not yet released a patch.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No vector assigned by NVD)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – Administrator
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: Medium (due to high privilege requirement but guaranteed DoS)

Deep Dive & Mechanics

The vulnerability resides in the Netskope NS Client driver loading mechanism. On Windows, kernel drivers must be properly signed and loaded through the Service Control Manager (SCM) or via a dedicated driver loader. The NS Client driver appears to lack proper validation of the caller’s integrity level or token, allowing a local Administrator to load it as a generic kernel service. When the driver is loaded incorrectly, it triggers a bug check (BSOD) due to an unhandled exception or invalid memory access in kernel mode.

The root cause is likely a missing or insufficient check in the driver’s DriverEntry or AddDevice routine that verifies the driver is being loaded by the legitimate Netskope service. An attacker with Administrator privileges can use standard Windows APIs (e.g., CreateService, StartService) to load the driver file directly, bypassing the intended loader.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is in the NS Client driver (likely nsclient.sys or similar). The patched version would include a check such as:

// Vulnerable: No validation of caller
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
    // ... initialization without checking caller
}

// Patched: Validate that the driver is loaded by the trusted service
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
    if (!IsLoadedByTrustedService()) {
        return STATUS_ACCESS_DENIED;
    }
    // ... safe initialization
}

Exploitation & Lab Setup

Red Team

Prerequisites: Local Administrator access on a Windows machine with Netskope NS Client installed.

Steps:

1. Identify the driver file (e.g., C:\Program Files\Netskope\NSClient\nsclient.sys).
2. Use sc or PowerShell to create a new service pointing to the driver:

   sc create FakeNetskope binPath= "C:\Program Files\Netskope\NSClient\nsclient.sys" type= kernel
   

3. Start the service:

   sc start FakeNetskope
   

4. The system will crash immediately with a BSOD.

Expected Outcome: Denial of service on the target machine.

Blue Team

Detection:

• Monitor for unexpected service creation events (Event ID 7045 in Windows Security Log).
• Look for driver load events (Event ID 7036 or 7034) from non-standard services.
• Use Sysmon Event ID 6 (Driver Load) to detect loading of nsclient.sys by a process other than the legitimate Netskope service.

Prevention:

• Restrict local Administrator privileges to trusted personnel only.
• Enable Windows Defender Application Control (WDAC) to allow only signed drivers from trusted publishers.
• Use Group Policy to prevent non-administrators from loading kernel drivers.

Indicators of Compromise (IOCs)

• File: nsclient.sys (hash unknown, but any load of this file by a non-Netskope service)
• Event ID 7045: Service creation with ImagePath pointing to nsclient.sys
• Event ID 7036: Service start for a service named other than the legitimate Netskope service
• BSOD Bug Check Code: Likely 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL) or 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA)

Detection Engineering

YARA Rule

rule CVE_2025_11156_Netskope_BSOD {
    meta:
        description = "Detects attempts to load Netskope NS Client driver as a generic kernel service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11156"
    strings:
        $driver_name = "nsclient.sys" nocase
        $service_create = "CreateService" nocase
        $kernel_type = "kernel" nocase
    condition:
        $driver_name and $service_create and $kernel_type
}

Sigma Rule

title: Suspicious Service Creation for Netskope Driver
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of a kernel service pointing to the Netskope NS Client driver by a non-Netskope process
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11156
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 7045
        ImagePath|contains: 'nsclient.sys'
        ServiceType: 'kernel mode driver'
    condition: selection
falsepositives:
    - Legitimate Netskope service updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11156 Netskope BSOD Exploit Attempt"; flow:to_server; content:"nsclient.sys"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict local Administrator accounts to only those absolutely necessary. Monitor for anomalous service creation.
• Short-term: Apply vendor patch when released. In the interim, use WDAC or AppLocker to block loading of nsclient.sys by any process other than the legitimate Netskope service.
• Long-term: Implement kernel driver signing enforcement and driver block rules via Group Policy.

Valters IT