hexatriene/nuc-winring0-fix

GitHubRepository PoCScanner

PoC files

11 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The repository provides PowerShell scripts to diagnose and mitigate the presence of the vulnerable WinRing0 driver (CVE-2020-14979) on Intel NUC systems. It does not contain code to exploit the vulnerability; instead, it checks for the driver's presence, blocks the associated device via Group Policy, and removes the driver to prevent exploitation.

Backdoor review

No backdoor observed in reviewed code

The repository contains PowerShell scripts and documentation for mitigating CVE-2020-14979 (WinRing0 vulnerable driver) on Intel NUC systems. All scripts perform legitimate system administration tasks: creating Group Policy registry keys to block device/driver installation, querying service and driver status, hiding Windows Updates, and cleaning up driver store files. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed. The scripts are transparent and their actions are clearly described in comments and console output.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPowerShell
Target softwareWinRing0.sysWinRing0x64.sysIntel NUC Software StudioEVGA Precision X1
Attack typesprivilege_escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is to detect and mitigate the presence of a vulnerable driver, not to exploit it. The scripts diagnose the system state (scanner) and apply configuration changes to block the driver. No code performs the arbitrary memory read/write or privilege escalation described in CVE-2020-14979.

README.md:1-5scripts/diagnose.ps1:1-8scripts/disable-device-gpo.ps1:1-8

Requirements

  • The scripts must be run as Administrator.scripts/disable-device-gpo.ps1:1
  • The target system must be an Intel NUC with the vulnerable ACPI device (ACPI\INTC1036) and associated driver.README.md:17

Observed behavior

  • Checks for the presence of the NucSoftwareStudioService, the vulnerable driver file (OpenHardwareMonitorLib.sys), and the associated ACPI device.scripts/diagnose.ps1:14-58
  • Creates Group Policy registry keys to block the ACPI\INTC1036 device ID, preventing the vulnerable driver from loading.scripts/disable-device-gpo.ps1:20-34
  • Removes the vulnerable driver from the Windows driver store and deletes associated files.scripts/remove-and-hide.ps1:30-60
  • Hides the specific Windows Update that reinstalls the vulnerable driver.scripts/remove-and-hide.ps1:71-91
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Registry Modification
HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\RestrictionsScripts create Group Policy device installation restrictions to block ACPI\INTC1036, which is the documented mitigation for the vulnerable driver.scripts/disable-device-gpo.ps1:22-27scripts/block-driver-updates.ps1:21-26
Service Management
NucSoftwareStudioServiceScripts stop and delete the service associated with the vulnerable driver, which is the documented removal target.scripts/remove-and-hide.ps1:20-25
Driver Store Cleanup
performancedriverextension.infScripts remove the vulnerable driver package from the Windows driver store using pnputil, consistent with the stated goal.scripts/remove-and-hide.ps1:31-40
Windows Update Hiding
Intel Corporation - ExtensionScripts hide the specific Windows Update that reinstalls the vulnerable driver, a documented mitigation step.scripts/remove-and-hide.ps1:72-84
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage is false, and 4 files are unclassified and omitted from the text content. The analysis is based on the 7 provided text files, which may not represent the entire repository.
  • Four files (out of 11 total) were omitted from the text evidence; their metadata indicates they are likely additional scripts or configuration files, but their content was not reviewed.
  • Binary files were not present in the evidence, so no binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1