CyberRota Analysis
AI-GeneratedA critical vulnerability exists in user-mode, memory-protected modules that can register arbitrary function pointers as global trace-full callbacks, allowing direct kernel calls without validation. This flaw can lead to denial-of-service (DoS) attacks through invalid pointer dereferences, and in some cases, it can execute code with kernel privileges, posing significant security risks. Organizations utilizing affected products, particularly those with user-mode modules and event tracing enabled, should prioritize immediate mitigation efforts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` module issuing kernel dispatch calls, on a build with `TX_ENABLE_EVENT_TRACE`. A user-mode, memory-protected module can register an arbitrary function pointer as the global trace-full callback. The kernel calls it directly — no validation, no trampoline — from privileged kernel code when the trace buffer wraps. An invalid pointer faults the kernel (DoS). A pointer into the module's own code was observed running with kernel privilege (`CONTROL.nPRIV = 0`), confirmed at runtime with a register capture inside that code.