CVE-2024-10972

Name of the Vulnerable Software and Affected Versions Velocidex WinPmem versions 4.1 and below

Description The issue is due to improper input validation, allowing an attacker with admin access to trigger a BSOD by changing the memory's access rights under the control of the user-mode application. This is possible because verification is only performed at the beginning of the routine, enabling userspace to change page permissions halfway through the routine. A valid workaround is a rule to detect unauthorized loading of winpmem outside incident response operations.

Recommendations For Velocidex WinPmem versions 4.1 and below, upgrade to the latest release to secure your systems. As a temporary workaround, consider implementing a rule to detect unauthorized loading of winpmem outside incident response operations.