Satoshi Tanda

The issue is related to a security-feature bypass vulnerability in the Hypervisor-Protected Code Integrity (HVCI) feature of the Windows operating system. This vulnerability allows attackers to bypass existing security restrictions, potentially enabling arbitrary kernel-mode code execution.

The issue is related to insufficient access control in the Windows Hyper-V hardware virtualization system, which can be exploited to elevate privileges. An elevation-of-privilege vulnerability allows attackers to affect the system.

The issue is related to the kernel mode driver kwatch3, which fails to properly handle crafted inputs. This failure leads to a stack-based buffer overflow. The exploitation of this issue may allow an attacker to execute arbitrary code.

The Dell `dbutil 2 3.sys` driver contains an insufficient access control vulnerability. This issue allows a local authenticated user to escalate privileges, cause a denial of service, or disclose protected information. In real-world incidents, the Lazarus group exploited this flaw using a Bring Your Own Vulnerable Driver (BYOVD) technique—where a legitimate but vulnerable driver is installed on the target system—to deploy the FudModule rootkit. This allowed the attackers to read and write kernel memory, effectively disabling multiple Windows security monitoring mechanisms to execute commands with kernel-level privileges. The campaign targeted individuals in the aerospace industry in the Netherlands and political journalists in Belgium via phishing emails disguised as job offers from Amazon.

Name of the Vulnerable Software and Affected Versions: ASUS UX360CA BIOS versions through 303 Description: The issue allows an attacker with ring 0 privilege to overwrite nearly arbitrary physical memory locations, including SMRAM, and execute arbitrary code in the SMM. Recommendations: For ASUS UX360CA BIOS versions through 303, update to a version later than 303 to resolve the issue. As a temporary workaround, consider restricting access to ring 0 privilege to minimize the risk of exploitation.

The issue allows local users to gain privileges via unknown vectors.

The issue is related to an unspecified vulnerability in the device driver, allowing local users to cause a denial of service via a crafted application.