Skip to content

04-mitigation.md

Latest commit

 

History

History
88 lines (64 loc) · 3.64 KB

04-mitigation.md

File metadata and controls

88 lines (64 loc) · 3.64 KB
Raw

Mitigation — CVE-2025-61155

The driver is legitimately signed, so "only allow signed drivers" does not help. The vulnerability is in the driver's logic, not its signature. Mitigation means stopping this specific (and other known-vulnerable) drivers from loading, and removing the one that is present.

1. Block the vulnerable driver from loading (recommended)

Microsoft Vulnerable Driver Blocklist (HVCI / Smart App Control)

Microsoft maintains a recommended driver blocklist that Windows enforces when Memory Integrity (HVCI) or Smart App Control is on. Enable it:

  • Settings → Privacy & security → Windows Security → Device security → Core isolation → Memory integrity = On, then reboot.
  • Or via policy: ensure the Microsoft Vulnerable Driver Blocklist is enabled (HKLM\SYSTEM\CurrentControlSet\Control\CI\Config\VulnerableDriverBlocklistEnable = 1).

Confirm the blocklist version is current; vulnerable-driver families are added over time.

WDAC custom policy (deny by hash / signer)

For environments that want an explicit, auditable deny, add a WDAC rule that blocks the driver by hash and/or by signer. Deny is more robust than allow-listing around a signed binary:

  • Deny SHA-256 9DDAE47FF968343A8C32A5344060257FDC08E2A7BDB9A227C8B3A584EE3C9F1E.
  • Optionally deny the signer Fedeen Games Limited for kernel images on hosts that never run Tower of Fantasy (scope carefully to avoid blocking a legitimate game install).

Generate the policy with the WDAC Wizard or New-CIPolicy / Merge-CIPolicy, deploy in audit mode first, then enforce.

App Control for Business

On Windows 11, App Control for Business policies can enforce the same deny rules fleet-wide via MDM/Intune.

2. Remove the driver if already present

  1. Identify the loaded driver / service:

    Get-CimInstance Win32_SystemDriver |
  Where-Object { $_.PathName -match 'GameDriverX64|UpdateCheckerX64' } |
  Select-Object Name, State, PathName

  2. Stop and delete the service (elevated):

    sc.exe stop  <serviceName>
sc.exe delete <serviceName>

  3. Remove the symbolic link / device only persists while loaded; once the service is removed and the host rebooted, \\.\HtAntiCheatDriver is gone. Delete the on-disk .sys file.

  4. If you do run Tower of Fantasy, update the game so the anti-cheat is replaced with a fixed driver version (> 7.23.4.7) rather than deleting it outright.

3. Detect-and-hunt while you roll out blocks

Blocking is preventative but rollout takes time. In parallel, hunt for the driver and for exploitation using 03-detection.md and the YARA / IOCs in ../detection/.

4. Defence-in-depth that limits the blast radius

  • HVCI / Memory Integrity on by default for all managed endpoints.
  • EDR self-protection / tamper protection enabled — though note that an in-kernel kill via this driver can still reach a PPL process; the value is in the alert it raises and in blocking the driver load earlier.
  • Attack-surface reduction: restrict who can install kernel services (driver installation requires admin; combine with least privilege so a compromised user can't install the driver in the first place — though once the driver is present, exploiting it needs no admin).

5. Vendor status

The defect is in the driver shipped with Tower of Fantasy (Hotta Studio / Perfect World, internal PwrdDriver / HtDriver2.0). Affected versions are <= 7.23.4.7. Track vendor updates for a corrected version; until the fixed driver is confirmed deployed, treat the blocklist + WDAC deny as the primary control.