CVE-2024-51324

LOWRansomware

Improper Privilege Management

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-51324 has a selected CVSS score of 3.8 (low); EIP currently links 1 repository PoC. VulnCheck reports CVE-2024-51324 use in known ransomware campaigns.

Description

An issue in the BdApiUtil driver of Baidu Antivirus v5.2.3.116083 allows attackers to terminate arbitrary process via executing a BYOVD (Bring Your Own Vulnerable Driver) attack.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 17, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck
Ransomware use
Observed · VulnCheck

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 12, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Baidu Antivirus

Browse Baidu / Baidu Antivirus
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHubI3r1h0n/SigurdRepository PoCby I3r1h0n16Exploit53 files

1.8 MiB · linked to 3 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Sigurd is a BYOVD exploitation tool written in Rust that installs vulnerable signed kernel drivers to terminate arbitrary user-mode processes. It supports multiple drivers, including ThrottleStop.sys for arbitrary physical memory read/write, and provides both a TUI and silent mode for configuration.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files constitute a BYOVD (Bring Your Own Vulnerable Driver) process termination tool named Sigurd. The code installs vulnerable signed drivers as Windows services and sends IOCTL requests to terminate specified processes. All observed behavior is consistent with the tool's stated purpose. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond process termination was found in the supplied readable source files.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesRust
Target softwareWindows kernelEDR/AV processes
Attack typesBYOVDprocess terminationprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional BYOVD exploitation tool that installs vulnerable drivers and uses them to terminate arbitrary processes. The README explicitly describes it as a 'BYOVD exploitation tool, made to kill processes' and the source code implements driver installation, service creation, and process termination via IOCTL exploitation.

README.md:18sigurd/src/killer/mod.rs:90-102sigurd/src/killer/mod.rs:194-208

Requirements

  • Requires administrator privileges to install and start the vulnerable driver service.sigurd/src/main.rs:40-43
  • Requires a configuration specifying a target driver and victim process names.sigurd/src/killer/mod.rs:50-53

Observed behavior

  • Installs a vulnerable signed kernel driver as a Windows service by writing the driver file to disk and creating the service via sc_create.sigurd/src/killer/mod.rs:90-102
  • Terminates target processes by resolving their PIDs and calling the driver's kill method, which exploits the driver's vulnerable IOCTL interface.sigurd/src/killer/mod.rs:194-208
  • Supports continuous mode to repeatedly kill target processes, and optionally uninstalls the driver service and cleans up files on exit.sigurd/src/killer/mod.rs:130-164sigurd/src/main.rs:164-178
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Driver Installation
Payload withheldThis is the core BYOVD technique described in the README and implemented in the killer module.sigurd/src/killer/mod.rs:90-102
Process Termination
Payload withheldThis matches the advertised 'kill processes' functionality.sigurd/src/killer/mod.rs:194-208
Driver Cleanup
Payload withheldThis is a standard cleanup routine for a BYOVD tool.sigurd/src/killer/mod.rs:130-164
Review boundaries

What the analysis did not establish

  • Binary driver files (13 .sys files) are present but not analyzed; their contents are flagged as binary and only metadata is provided.
  • Only 8 of 35 text files are included; 27 text files are omitted, including individual driver exploit implementations (e.g., throttlestop/mod.rs, bdapiutil64/mod.rs) that would contain the actual IOCTL exploitation logic.
  • The evidence does not include the full source code for all driver exploit modules, limiting verification of the exact exploitation techniques for each driver.
  • 13 binary driver files (e.g., BdApiUtil64.sys, ThrottleStop.sys) were not analyzed; their internal behavior could differ from the tool's intended IOCTL usage.
  • 27 additional text files in the repository were not included in the evidence packet and were not reviewed.
  • The review is limited to static source code analysis; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2