34 matches found
CVE-2024-21305
CVE-2024-21305 This repo contains the report and PoC of CVE-2024-21305, the non-secure Hypervisor-Protected Code Integrity HVCI configuration vulnerability. This vulnerability allowed arbitrary kernel-mode code execution, effectively bypassing HVCI, within the root partition. For the root cause,...
edk2
============== EDK II Project A modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications from www.uefi.org. .. image::...
CVE-2021-21551
CVE-2021-21551 A PoC that exploits Dell's dbutil23 driver. Will get code execution on a system that has HVCI disabled as shown below: Ouptut: The write-up for this code can be found here: https://ch3rn0byl.com/2021/05/a-dell-cve-2021-21551/...
HVCIPwned
CVE-2024-35250 Local privilege escalation via untrusted pointer dereference in Windows Kernel Streaming driver ks.sys. Data-only exploit — bypasses Hypervisor-protected Code Integrity HVCI. Summary Field| Detail ---|--- CVE| CVE-2024-35250 Component| ks.sys Kernel Streaming Bug Class| Untrusted...
CVE-2024-21338
CVE-2024-21338 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled. Compiling Use Microsoft Visual Studio with the C++ package to successfully compile the PoC on both Release and Debug modes. Post Original blog post:...
CVE-2024-21338
CVE-2024-21338 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled. Compiling Use Microsoft Visual Studio with the C++ package to successfully compile the PoC on both Release and Debug modes. Post Original blog post:...
ZeroHVCI
ZeroHVCI - Defeating HVCI without admin privileges or a kernel driver ZeroHVCI accomplishes arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity HVCI protected environments calling without admin permissions or kernel drivers. Features Full non-privileged kernel...
Blackout
Blackout leveraging gmer driver to effectively disabling or killing EDRs and AVs. it bypass HVCI fluently the sample is sourced from loldrivers https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/ usage Place the driver Blackout.sys in the same path as the executable The...
CVE-2024-21338-x64-build-
CVE-2024-21338 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled...
CVE-2025-7771-Vulnerability-Exploration
🔓 ThrottleStop.sys Kernel Exploit — HVCI-Compatible Physical Memory Mapper CVE-2025-7771 — Arbitrary Physical Memory Read/Write via ThrottleStop.sys IOCTLs ⚠️ Disclaimer This project is published for educational and research purposes only. The goal is to demonstrate how a signed, trusted kernel...
EUVD-2024-19140
Malicious code in bioql PyPI...
CVE-2025-59033: Unprotected Alternate Channel
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control WDAC policy. Entries that specify only the to-be-signed TBS part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a...
Exploit for Untrusted Pointer Dereference in Microsoft
CVE-2024-21338 Local Privilege Escalation from Admin to Kernel...
Exploit for Untrusted Pointer Dereference in Microsoft
CVE-2024-21338 Local Privilege Escalation from Admin to Kernel...
CVE-2024-21431
CVE-2024-21431 is a Microsoft Windows vulnerability titled “Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability.” Connected sources identify this as a local, high-severity issue affecting the HVCI mechanism, with a CVSS score in the high range (confidentiality, integr...
CVE-2024-21431 Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability
...
CVE-2024-21431: Incorrect Permission Assignment for Critical Resource
Hypervisor-Protected Code Integrity HVCI Security Feature Bypass Vulnerability...
Security feature bypass
Hypervisor-Protected Code Integrity HVCI Security Feature Bypass Vulnerability...
CVE-2024-21305
CVE-2024-21305 is a Hypervisor-Protected Code Integrity (HVCI) security feature bypass affecting Windows; the CVE entry notes a local attack surface with high privileges required and no user interaction (per CVSS details). Connected Microsoft documentation confirms the vulnerability and lists it ...