When the Hardware Isn't There: Coaxing Vulnerable Drivers Into Range
BYOVD research keeps colliding with a stubborn problem — many kernel drivers refuse to talk unless their device is plugged in. New work shows how to make them talk anyway.
The driver sat there refusing to answer. On the analyst's screen, a fresh IOCTL fuzzer was firing into a signed Windows kernel driver pulled from a GPU vendor's installer, and every call came back the same way: STATUS_NO_SUCH_DEVICE. The vulnerable code path was right there in IDA, reachable on paper. In practice, the driver wanted hardware that nobody on the team owned, and probably nobody outside a specific datacenter in Taiwan owned either.
That scene, repeated across hundreds of driver audits, is the quiet bottleneck in Bring Your Own Vulnerable Driver research. New technical work circulating this week lays out how researchers are sidestepping the hardware gate entirely, with implications for both offensive tooling and defenders trying to predict which signed drivers will end up on Microsoft's vulnerable driver blocklist next.
The core trick is unglamorous and effective. Most Windows kernel drivers gate their dispatch routines on a successful call to functions like IoGetDeviceProperty or on PCI enumeration handshakes that only succeed when the expected vendor and device ID are present on the bus. Patch those checks out — or, more elegantly, emulate the bus response in a thin shim above the driver — and the rest of the driver's attack surface lights up. IOCTLs that previously returned early now reach the MmMapIoSpace calls, the arbitrary MSR writes, the physical memory primitives that make BYOVD attractive in the first place.
And that is the uncomfortable part. A driver shipped for a discontinued RAID card from 2014 may carry a textbook arbitrary write. Without hardware, it looked unreachable. With a fifty-line emulation layer, it is a loaded weapon any attacker with admin rights can carry onto a fully patched Windows 11 box and use to disable EDR.
The technique is not new in spirit. Lazarus reached for a Dell driver, CVE-2021-21551, to blind endpoint sensors years ago. Scattered Spider has been seen loading Zemana's anti-malware driver for the same purpose. What is shifting is the speed of discovery. If the hardware gate is no longer a filter, the population of "interesting" signed drivers grows by an order of magnitude, and so does the workload for the team at Microsoft maintaining the blocklist.
One researcher familiar with the work put it bluntly. "We were treating 'needs hardware' as a mitigation," they said. "It was never a mitigation. It was a speed bump, and we just took the speed bump out."
The driver on the analyst's screen, the one that wouldn't answer, eventually did. It crashed the kernel on the fourth IOCTL.
