Full Report
Microsoft had discovered five Paragon Partition Manager BioNTdrv.sys driver flaws, with one used by ransomware gangs in zero-day attacks to gain SYSTEM privileges in Windows. [...]
Analysis Summary
# Vulnerability: Privilege Escalation via Vulnerable Paragon Partition Manager Driver (BYOVD)
## CVE Details
- CVE ID: CVE-2025-0298 (The context explicitly mentions this CVE number for the actively exploited flaw, though the severity is not explicitly provided.)
- CVSS Score: N/A (Not explicitly stated in the text, but implies High due to SYSTEM privilege escalation being achieved.)
- CWE: N/A (Driver vulnerability leading to privilege escalation)
## Affected Systems
- Products: Paragon Partition Manager, Paragon Hard Disk Manager
- Versions: Paragon Partition Manager versions 17 and older (for CVE-2025-0298); versions 7.9.1 and previous (for other unspecified flaws mentioned).
- Configurations: Targets Windows devices where the vulnerable driver (`BioNTdrv.sys`) is present or can be loaded.
## Vulnerability Description
A critical vulnerability exists within the Paragon Partition Manager software, specifically in the driver file `BioNTdrv.sys`. This flaw allows an attacker with local access (or even remote actors using a 'Bring Your Own Vulnerable Driver' - BYOVD - methodology) to load the vulnerable driver and subsequently achieve SYSTEM-level privilege escalation on the Windows host system. Threat actors are reportedly using this flaw in conjunction with ransomware attacks.
## Exploitation
- Status: Exploited in the wild (Reported to be actively exploited by ransomware gangs).
- Complexity: Low/Medium (BYOVD allows for relatively straightforward privilege escalation once the actor has a foothold, bypassing security controls).
- Attack Vector: Local (Typically, BYOVD requires some initial code execution or method to load the driver, often chained after an initial compromise).
## Impact
- Confidentiality: High (SYSTEM privileges allow for full access).
- Integrity: High (SYSTEM privileges allow for full system modification).
- Availability: High (SYSTEM privileges allow disruption or complete shutdown/encryption).
## Remediation
### Patches
- **Paragon Partition Manager:** Upgrade to the latest version which ships with `BioNTdrv.sys` version 2.0.0 or higher, addressing all known flaws.
- **Paragon Hard Disk Manager:** Users must upgrade immediately as the vulnerable driver will soon be blocked by Microsoft.
### Workarounds
1. **Enable Microsoft Vulnerable Driver Blocklist:** This is critical for preventing known vulnerable drivers, including the one associated with this flaw, from loading.
* Path to check/enable: **Settings** → **Privacy & security** → **Windows Security** → **Device security** → **Core isolation** → **Microsoft Vulnerable Driver Blocklist** (Ensure this is enabled).
## Detection
- **Indicators of Compromise (IoCs):** Look for the loading of the vulnerable driver (`BioNTdrv.sys`) associated with older versions of Paragon software, especially if the patched software version installed does not correlate with its presence.
- **Detection Methods and Tools:** Monitor for attempts to load drivers that match the signature of the vulnerable software/driver version. Rely on Windows Defender/Security Center to enforce the Vulnerable Driver Blocklist.
## References
- Vendor Advisory: Paragon Software site warning regarding required Hard Disk Manager updates.
- Microsoft Documentation: Information pertaining to the Microsoft Vulnerable Driver Blocklist feature.
- News Source: bleepingcomputer dot com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/