Vulnerability in Velocidex Winpmem
CVE-2024-10972
Velocidex WinPmem versions 4.1 and below suffer from an Improper Input Validation vulnerability whereby an attacker with admin access can trigger a BSOD with a parallel thread changing the memory’s access right under the control of the user-mode application. This is due to verification only being performed at the beginning of the routine allowing the userspace to change page permissions half way through the routine. A valid workaround is a rule to detect unauthorized loading of winpmem outside incident response operations.
Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)
EPSS: 0.002 (5.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H.
Affected products
- Velocidex Winpmem — versions <= 4.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-10972?
- CVE-2024-10972 is a high-severity vulnerability in Velocidex Winpmem, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 7.3/10. Published 2024-12-16.
- How severe is CVE-2024-10972?
- High severity. CVSS v3 base score is 7.3 out of 10.