vulnerable driver Archives

Winsage

April 22, 2025

Windows 10 KB5055612 preview update fixes a GPU bug in WSL2

Microsoft has released the optional KB5055612 preview cumulative update for Windows 10 22H2, which addresses a GPU paravirtualization issue in the Windows Subsystem for Linux 2 (WSL2). This update is part of Microsoft's initiative for optional non-security preview updates, typically available at the end of each month, allowing administrators to test upcoming fixes and features. The update does not include security updates and can be installed manually through Windows Update or downloaded from the Microsoft Update Catalog. The key changes in the KB5055612 update include security improvements to internal Windows OS functionality, a fix for the case-sensitive GPU paravirtualization check in WSL2, and updates to the Windows Kernel Vulnerable Driver Blocklist to include drivers with known vulnerabilities exploited in BYOVD attacks. Microsoft has noted two known issues: one related to the Citrix Session Recording Agent (SRA) version 2411 causing update failures, with a suggested workaround, and another involving an Event 7023 error in Windows EventViewer regarding SgrmBroker.exe, which is currently non-functional and can be ignored. A fix for this bug is expected in future updates.

Winsage

April 15, 2025

Releasing Windows 10 Build 19045.5794 to the Release Preview Channel

Windows 10 22H2 Build 19045.5794 (KB5055612) is now available in the Release Preview Channel for Insiders. Key features include a fix for the GPU paravirtualization check in Windows Subsystem for Linux 2 (WSL2), which was previously case-sensitive, and updates to the Windows Kernel Vulnerable Driver Blocklist to include drivers with security vulnerabilities exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks.

Winsage

March 30, 2025

A Windows 11 update causes issues with some Lenovo laptops

Windows 11 has encountered issues affecting Lenovo ThinkPad laptops, where a recent security update has blocked the installation of a crucial BIOS update. This problem is linked to changes in the Vulnerable Driver Blocklist and modifications to the WinFlash64.exe file. Lenovo ThinkPad owners receive an error message when attempting to update their BIOS through the BIOS Update Utility or Vantage app. Lenovo is rolling out a new BIOS version 1.61 to address the issue and recommends using Windows Update for the BIOS update. Additionally, Microsoft is phasing out Windows 10, with support ending on October 14, 2025, and encouraging users to upgrade to Windows 11. Over 50% of Windows users still operate on Windows 10, despite the rise in Windows 11 users. Microsoft has been notifying Windows 10 users about potential security risks and offering a streamlined upgrade process to Windows 11, which can be done for free, though it may involve some downtime.

Winsage

March 29, 2025

Windows 11 update flags a core Lenovo tool as risky – and it’s causing problems

Lenovo ThinkPad users are experiencing difficulties with BIOS updates due to a modification by Microsoft affecting the executable file WinFlash64.exe, following recent Windows 11 and Windows 10 updates. The latest Windows patches (24H2, 23H2, and 22H2 for Windows 11, and 22H2 for Windows 10) have categorized the BIOS update as a 'vulnerable driver,' preventing installation. Users report failures when using Lenovo's BIOS Update Utility or the Lenovo Vantage app. A fix is in development, and users may try applying the BIOS update through Windows Update if available. Lenovo plans to release a resolution with BIOS version v1.61.

Tech Optimizer

March 21, 2025

Cybercriminals Exploit CheckPoint Driver Flaws in Malicious Campaign

A report by Nima Bagheri reveals that CheckPoint’s ZoneAlarm antivirus software is being exploited by threat actors using a method called Bring Your Own Vulnerable Driver (BYOVD). This attack targets vulnerabilities in the vsdatant.sys driver, which operates with high-level kernel privileges, allowing attackers to bypass Windows security measures. Specifically, version 14.1.32.0 of vsdatant.sys, released in 2016, contains vulnerabilities that enable attackers to circumvent the Windows Memory Integrity feature, gaining access to sensitive information and establishing persistent connections to compromised systems. Bagheri advises users to update to the latest version of vsdatant.sys, which is not vulnerable. CheckPoint confirmed that the outdated driver is no longer in use and that users running the latest versions of ZoneAlarm or Harmony Endpoint are not affected.