CVE-2020-14979

HIGH

EVGA Precision WinRing0.sys and WinRing0x64.sys Privilege Escalation Vulnerability

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-14979 has a selected CVSS score of 7.8 (high); EIP currently links 1 repository PoC.

Description

The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low integrity processes, to read and write to arbitrary memory locations. This allows any user to gain NT AUTHORITY\SYSTEM privileges by mapping \Device\PhysicalMemory into the calling process.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 6, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1

Affected products and versions

1
ProductSourceVersion range

precision_x1

Browse evga / precision_x1
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHubhexatriene/nuc-winring0-fixRepository PoCby hexatriene6Scanner11 files

27.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The repository provides PowerShell scripts to diagnose and mitigate the presence of the vulnerable WinRing0 driver (CVE-2020-14979) on Intel NUC systems. It does not contain code to exploit the vulnerability; instead, it checks for the driver's presence, blocks the associated device via Group Policy, and removes the driver to prevent exploitation.

Backdoor review

No backdoor observed in reviewed code

The repository contains PowerShell scripts and documentation for mitigating CVE-2020-14979 (WinRing0 vulnerable driver) on Intel NUC systems. All scripts perform legitimate system administration tasks: creating Group Policy registry keys to block device/driver installation, querying service and driver status, hiding Windows Updates, and cleaning up driver store files. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed. The scripts are transparent and their actions are clearly described in comments and console output.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPowerShell
Target softwareWinRing0.sysWinRing0x64.sysIntel NUC Software StudioEVGA Precision X1
Attack typesprivilege_escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary operation is to detect and mitigate the presence of a vulnerable driver, not to exploit it. The scripts diagnose the system state (scanner) and apply configuration changes to block the driver. No code performs the arbitrary memory read/write or privilege escalation described in CVE-2020-14979.

README.md:1-5scripts/diagnose.ps1:1-8scripts/disable-device-gpo.ps1:1-8

Requirements

  • The scripts must be run as Administrator.scripts/disable-device-gpo.ps1:1
  • The target system must be an Intel NUC with the vulnerable ACPI device (ACPI\INTC1036) and associated driver.README.md:17

Observed behavior

  • Checks for the presence of the payload withheld, the vulnerable driver file (OpenHardwareMonitorLib.sys), and the associated ACPI device.scripts/diagnose.ps1:14-58
  • Creates Group Policy registry keys to block the ACPI\INTC1036 device ID, preventing the vulnerable driver from loading.scripts/disable-device-gpo.ps1:20-34
  • Removes the vulnerable driver from the Windows driver store and deletes associated files.scripts/remove-and-hide.ps1:30-60
  • Hides the specific Windows Update that reinstalls the vulnerable driver.scripts/remove-and-hide.ps1:71-91
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Registry Modification
Payload withheldScripts create Group Policy device installation restrictions to block ACPI\INTC1036, which is the documented mitigation for the vulnerable driver.scripts/disable-device-gpo.ps1:22-27scripts/block-driver-updates.ps1:21-26
Service Management
Payload withheldScripts stop and delete the service associated with the vulnerable driver, which is the documented removal target.scripts/remove-and-hide.ps1:20-25
Driver Store Cleanup
Payload withheldScripts remove the vulnerable driver package from the Windows driver store using pnputil, consistent with the stated goal.scripts/remove-and-hide.ps1:31-40
Windows Update Hiding
Payload withheldScripts hide the specific Windows Update that reinstalls the vulnerable driver, a documented mitigation step.scripts/remove-and-hide.ps1:72-84
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage is false, and 4 files are unclassified and omitted from the text content. The analysis is based on the 7 provided text files, which may not represent the entire repository.
  • Four files (out of 11 total) were omitted from the text evidence; their metadata indicates they are likely additional scripts or configuration files, but their content was not reviewed.
  • Binary files were not present in the evidence, so no binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2