CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections. ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions.

CVSS

No CVSS.

References

Link	Resource
https://github.com/klsecservices/Advisories/blob/master/K-TechPowerUp-2025-001.md
https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/
https://www.techpowerup.com/download/techpowerup-throttlestop/

Configurations

No configuration.

History

06 Aug 2025, 20:23

Type	Values Removed	Values Added
Summary		(es) ThrottleStop.sys, un controlador legítimo, expone dos interfaces IOCTL que permiten acceso arbitrario de lectura y escritura a la memoria física mediante la función MmMapIoSpace. Esta implementación insegura puede ser explotada por una aplicación maliciosa en modo usuario para parchear el kernel de Windows en ejecución e invocar funciones arbitrarias del kernel con privilegios de anillo 0. Esta vulnerabilidad permite a atacantes locales ejecutar código arbitrario en el contexto del kernel, lo que resulta en una escalada de privilegios y posibles ataques posteriores, como la desactivación del software de seguridad o la evasión de las protecciones a nivel de kernel. La versión 3.0.0.0 de ThrottleStop.sys y posiblemente otras se ven afectadas. Aplique las actualizaciones según las instrucciones del proveedor.

06 Aug 2025, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-06 10:15

Updated : 2025-08-06 20:23

NVD link : CVE-2025-7771

Mitre link : CVE-2025-7771

CVE.ORG link : CVE-2025-7771

JSON object : View

Products Affected

No product.

CWE

CWE-782

Exposed IOCTL with Insufficient Access Control

{"id": "CVE-2025-7771", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@kaspersky.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-06T10:15:35.597", "references": [{"url": "https://github.com/klsecservices/Advisories/blob/master/K-TechPowerUp-2025-001.md", "source": "vulnerability@kaspersky.com"}, {"url": "https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/", "source": "vulnerability@kaspersky.com"}, {"url": "https://www.techpowerup.com/download/techpowerup-throttlestop/", "source": "vulnerability@kaspersky.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "vulnerability@kaspersky.com", "description": [{"lang": "en", "value": "CWE-782"}]}], "descriptions": [{"lang": "en", "value": "ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke arbitrary kernel functions with ring-0 privileges. The vulnerability enables local attackers to execute arbitrary code in kernel context, resulting in privilege escalation and potential follow-on attacks, such as disabling security software or bypassing kernel-level protections.\u00a0ThrottleStop.sys version 3.0.0.0 and possibly others are affected. Apply updates per vendor instructions."}, {"lang": "es", "value": "ThrottleStop.sys, un controlador leg\u00edtimo, expone dos interfaces IOCTL que permiten acceso arbitrario de lectura y escritura a la memoria f\u00edsica mediante la funci\u00f3n MmMapIoSpace. Esta implementaci\u00f3n insegura puede ser explotada por una aplicaci\u00f3n maliciosa en modo usuario para parchear el kernel de Windows en ejecuci\u00f3n e invocar funciones arbitrarias del kernel con privilegios de anillo 0. Esta vulnerabilidad permite a atacantes locales ejecutar c\u00f3digo arbitrario en el contexto del kernel, lo que resulta en una escalada de privilegios y posibles ataques posteriores, como la desactivaci\u00f3n del software de seguridad o la evasi\u00f3n de las protecciones a nivel de kernel. La versi\u00f3n 3.0.0.0 de ThrottleStop.sys y posiblemente otras se ven afectadas. Aplique las actualizaciones seg\u00fan las instrucciones del proveedor."}], "lastModified": "2025-08-06T20:23:37.600", "sourceIdentifier": "vulnerability@kaspersky.com"}