CVE-2024-55413
Published: 07 January 2025
Summary
CVE-2024-55413 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Sunix (inferred from references). Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 9.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-41 (Port and I/O Device Access) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-55413 is a vulnerability in the snxppamd.sys driver included in the SUNIX Parallel Driver x64 version 10.1.0.0. It enables low-privileged users to read and write arbitrary I/O ports via specially crafted IOCTL requests. This issue, published on 2025-01-07 and associated with CWE-787, carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability to achieve privilege escalation, execute code under high privileges, and disclose sensitive information. The driver, being signed, can also bypass Microsoft's driver-signing policy, facilitating the deployment of malicious code.
Details on the vulnerability, including the affected driver, are documented in a GitHub repository at https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55413/CVE-2024-55413_snxppamd.sys_README.md, with the vendor site available at https://www.sunix.com/tw/. No specific mitigation or patch details are outlined in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52768
Vulnerability details
A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under…
more
high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerable signed kernel driver directly enables local privilege escalation via arbitrary I/O port access (T1068) and subverts driver code-signing enforcement to load abusive code (T1553.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of IOCTL inputs to the snxppamd.sys driver, preventing specially crafted requests from enabling arbitrary I/O port read/write.
Restricts unauthorized access to I/O ports and devices, directly blocking the arbitrary I/O port read/write exploitation in the vulnerable driver.
Mandates timely remediation of the known flaw in snxppamd.sys through patching, disabling, or removal to eliminate privilege escalation and code execution risks.