Windows HX Agent driver file fekern.sys gives attackers extra system powers

Summary

A security issue in the HX Agent driver file fekern.sys allows hackers with access to a Windows system to gain extra system powers. This could let them access sensitive information and take control of the system. To stay safe, make sure to keep the HX Agent up to date with the latest version.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
trellix	endpoint_security	> 30.0.0 , <= 34.0.0	–
trellix	endpoint_security	35.31.0-37	–
trellix	endpoint_security	36.30.0-17	–

Original title

A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulne...

Original description

A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver (BYOVD) was leveraged to gain access to the critical Windows process memory lsass.exe (Local Security Authority Subsystem Service). The fekern.sys is a driver file associated with the HX Agent (used in all existing HX Agent versions). The vulnerable driver installed in a product or a system running a fully functional HX Agent is, itself, not exploitable as the product’s tamper protection restricts the ability to communicate with the driver to only the Agent’s processes.

nvd CVSS3.1 7.8

nvd CVSS4.0 6.2

Vulnerability type

CWE-20 Improper Input Validation

https://thrive.trellix.com/s/article/000015100 Permissions Required