We were recently notified of a potential security vulnerability in the HW Driver that applies to all versions (1.0 - 5.0.4.0).
To date, we have not received any report of any bad actors that exploited the vulnerability but we have taken an action to address it and improve the cyber-protection of the HW Driver.
The vulnerability was fixed and a new and improved HW Driver software package v5.0.5.0 is now available to replace the existing HW driver. The new version is backward compatible with all prior versions and you should not see any issues with using your other MTS software such as HW, GXDMM, GTDIO, GXFPGA, etc.). More details about the vulnerability is available in the HW ReadMe.txt found in the HW download area, list below.
Addressed CVEsThe following are the CVEs issued:- CVE-2024-36054 Description-- Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory (and consequently gain all privileges) via IOCTL 0x9c4064b8 (via MmMapIoSpace) and IOCTL 0x9c406490 (via ZwMapViewOfSection).
- CVE-2024-36055 Description-- Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory with read/write access via the MmMapIoSpace API (IOCTL 0x9c40a4f8, 0x9c40a4e8,
0x9c40a4c0, 0x9c40a4c4, 0x9c40a4ec, and seven others), leading to a denial of service (BSOD).
- CVE-2024-36056 Description-- Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory via IOCTL 0x9c406490 (for IoAllocateMdl, MmBuildMdlForNonPagedPool, and MmMapLockedPages), leading to NT AUTHORITY\SYSTEM privilege escalation.
Affected ProductsThe HW driver is bundled with many of our products including ATEasy and other software driver packages such as: GXDMM, GTDIO, GXFPGA, GXPIO, and more.
SolutionUpdate you HW and install HW v5.0.5.0 or newer. Download HW.exe and install it using the following link:
HW download
See AlsoTo learn more about the new HW driver, please use the following links:If you have any questions, please use Marvin Test Solutions Support Portal - Magic
|