CVE-2025-14963

Executive Summary

CVE-2025-14963 identifies a privilege escalation vulnerability in the VMware HX Agent driver file fekern.sys. This driver, when installed as part of the HX Agent, can be exploited via a Bring Your Own Vulnerable Driver (BYOVD) attack. A local attacker with user-level access can load a vulnerable driver to interact with the Windows kernel, specifically targeting the lsass.exe process to dump credentials and gain SYSTEM privileges. The vulnerability is not directly exploitable on a fully functional HX Agent due to tamper protection, but the driver itself remains vulnerable if loaded outside the agent's control. No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

This vulnerability does not involve NPM, PyPI, Go, or Ruby packages. It is a driver-level issue within the VMware HX Agent software, which is typically deployed in enterprise environments as part of VMware's hyper-converged infrastructure.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for scoring. However, based on the description, the vulnerability would likely score high due to the potential for privilege escalation and credential theft. A hypothetical vector might be:

• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. The ability to gain SYSTEM privileges and dump lsass.exe memory poses a severe risk to domain security.

Deep Dive & Mechanics

The vulnerability resides in the fekern.sys driver, which is part of the VMware HX Agent. This driver provides kernel-level functionality for the agent. The BYOVD technique involves an attacker bringing their own copy of a vulnerable driver (in this case, fekern.sys) and loading it into the kernel. Once loaded, the driver can be used to access protected process memory, such as lsass.exe, which stores authentication credentials.

The attack flow:

1. Initial Access: The attacker gains local user access to the target system (e.g., via phishing, lateral movement).
2. Driver Loading: The attacker loads a vulnerable version of fekern.sys using a tool like sc.exe or a custom loader.
3. Kernel Exploitation: The driver provides arbitrary read/write capabilities to kernel memory, allowing the attacker to read lsass.exe process memory.
4. Credential Dump: Tools like Mimikatz can then be used to extract credentials from the dumped memory.
5. Privilege Escalation: With SYSTEM privileges, the attacker can move laterally or escalate to domain admin.

The tamper protection in the HX Agent prevents communication with the driver from non-agent processes, but the driver itself is still vulnerable if loaded independently.

Vulnerable vs. Patched Code

No patched code is available. The vulnerability is inherent to the driver's design. The only mitigation is the tamper protection feature, which restricts driver access to the HX Agent processes. No code diff is available.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local user access on a Windows system.
• A vulnerable copy of fekern.sys (version unknown).
• Tools: sc.exe, Mimikatz, or a custom driver loader.

Steps:

1. Load the vulnerable driver:

   sc create fekern binPath= C:\path\to\fekern.sys type= kernel
   sc start fekern
   

2. Use a tool to interact with the driver to read lsass.exe memory. This may require a custom exploit or a tool like Mimikatz with a driver plugin.
3. Dump credentials:

   mimikatz.exe privilege::debug sekurlsa::logonpasswords exit
   

Note: No public exploit code is available. The above is a generic BYOVD attack flow.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected driver loading events (Event ID 7045).
• Monitor for sc.exe usage by non-admin users.
• Monitor for access to lsass.exe process memory (Event ID 10, Sysmon).
• Use YARA rules to detect fekern.sys in unusual locations.

Defense:

• Enable Windows Defender Application Control (WDAC) to block unsigned drivers.
• Use Microsoft's recommended driver block rules.
• Ensure the HX Agent tamper protection is enabled.
• Restrict local user privileges.

Indicators of Compromise (IOCs)

• File: fekern.sys (SHA256 unknown)
• Process: lsass.exe accessed by non-system processes
• Event Logs:
  • Event ID 7045: Service creation for fekern
  • Event ID 10 (Sysmon): Process access to lsass.exe
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\fekern
• Network: No network IOCs expected (local exploit)

Detection Engineering

YARA Rule

rule detect_fekern_driver {
    meta:
        description = "Detects the vulnerable fekern.sys driver file"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14963"
    strings:
        $s1 = "fekern.sys" nocase
        $s2 = "HX Agent" nocase
        $s3 = "VMware" nocase
    condition:
        $s1 or ($s2 and $s3)
}

Sigma Rule

title: Detection of fekern.sys Driver Loading
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects the loading of the vulnerable fekern.sys driver via service creation
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName: 'fekern'
    condition: selection
falsepositives:
    - Legitimate HX Agent installation (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-14963 fekern.sys BYOVD Attempt"; flow:to_server; content:"fekern.sys"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Ensure HX Agent tamper protection is enabled. This prevents non-agent processes from communicating with the driver.
• Short-term: Monitor for unauthorized driver loading using the provided detection rules.
• Long-term: Await an official patch from VMware. In the meantime, consider using Windows Defender Application Control (WDAC) to block unsigned drivers.
• Workaround: If the HX Agent is not critical, uninstall it to remove the vulnerable driver.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert