CVE-2024-55412
Published: 07 January 2025
Summary
CVE-2024-55412 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Sunix (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-41 (Port and I/O Device Access) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-55412 is a vulnerability in the snxpsamd.sys driver within SUNIX Serial Driver x64 version 10.1.0.0. It enables low-privileged users to read and write arbitrary I/O ports through specially crafted IOCTL requests. The issue, published on 2025-01-07, carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-787.
Low-privileged local attackers can exploit this vulnerability to achieve privilege escalation, execute code under high privileges, and perform information disclosure. As a signed driver, it can also bypass Microsoft's driver-signing policy, facilitating the deployment of malicious code.
Details on the vulnerability, including potential exploitation techniques, are available in the GitHub repository at https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55412/CVE-2024-55412_snxpsamd.sys_README.md. The vendor website is at https://www.sunix.com/tw/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52767
Vulnerability details
A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under…
more
high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerable signed driver enables local privilege escalation via arbitrary I/O port access (T1068) and bypasses driver code signing enforcement to load malicious kernel code (T1553.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly restricts low-privileged access to I/O ports and devices, preventing exploitation of arbitrary read/write via crafted IOCTLs in snxpsamd.sys.
Requires validation of IOCTL inputs to the vulnerable driver, blocking specially crafted requests that enable privilege escalation and information disclosure.
Mandates timely identification, reporting, and correction of flaws like the IOCTL vulnerability in the SUNIX snxpsamd.sys driver.