Trellix HX Agent Privilege Escalation Vulnerability via Vulnerable Driver

A vulnerability in the Trellix HX Agent driver file fekern.sys allows local users to gain elevated system privileges. This issue arises from the exploitation of a vulnerable driver in conjunction with the Bring Your Own Vulnerable Driver (BYOVD) technique, enabling access to critical Windows process memory, specifically lsass.exe (Local Security Authority Subsystem Service). The fekern.sys driver is associated with all existing versions of Trellix HX Agent). However, the vulnerability cannot be exploited directly, as the product's tamper protection limits communication with the driver to the agent's processes.

Impact

Exploitation of this vulnerability allows local users to gain elevated system privileges, potentially leading to unauthorized access or modifications within the system.