Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users to read or write arbitrary MSRs, and gain privileges and load unsigned drivers, via the (1) IOCTL_RDMSR 0x9C402438 and (2) IOCTL_WRMSR 0x9C40243C IOCTLs to \Device\speedfan, as demonstrated by an IOCTL_WRMSR action on MSR_LSTAR.
First seen exploited 10 years after disclosure. Public exploit code (Exploit-DB) was available 5 days before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Reports are matched by finding the exact id CVE-2007-5633 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
WHITE 6.3 Speedfan exploit chain In the Speedfan exploit execution chain, InvisiMole uses the Bring Your Own Vulnerable Driver technique to load the speedfan.sys driver on the compromised system, and then exploit local privilege escalation vulnerability (CVE-2007-5633) to gain code execution in kernel…
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.