CVE-2024-55414: Motorola SM56 Modem Driver Escalation

CVE-2024-55414 Overview

CVE-2024-55414 is a driver vulnerability in SmSerl64.sys, a component of the Motorola SM56 Modem WDM Driver version 6.12.23.0. The driver exposes IOCTL handlers that allow low-privileged users to map arbitrary physical memory into user space. Attackers can abuse this primitive to escalate privileges, execute code in kernel context, and disclose sensitive memory contents. Because SmSerl64.sys carries a valid Microsoft signature, threat actors can also load it on systems where they do not control signing infrastructure, bypassing the Microsoft driver-signing policy as part of a Bring Your Own Vulnerable Driver (BYOVD) attack chain. The flaw is categorized under [CWE-77].

Critical Impact
Local users can map physical memory through crafted IOCTL requests, enabling kernel-level code execution and BYOVD-style driver-signing policy bypass.

Affected Products

Motorola SM56 Modem WDM Driver SmSerl64.sys version 6.12.23.0
Windows systems with the signed SmSerl64.sys driver loaded
Endpoints where attackers can side-load the vulnerable signed driver (BYOVD scenario)

Discovery Timeline

2025-01-07 - CVE-2024-55414 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-55414

Vulnerability Analysis

The SmSerl64.sys kernel driver registers an I/O control interface that is reachable from user-mode processes without administrative privileges. One or more IOCTL handlers accept caller-supplied physical addresses and lengths, then map the requested region into the calling process. The driver performs no meaningful validation of the requested address range, the requester's privilege level, or the sensitivity of the underlying memory. A local attacker therefore gains a read/write primitive over arbitrary physical memory, including kernel pages, page tables, and credential structures held in non-paged pool.

With this primitive, an attacker can locate the EPROCESS structure of a privileged process and overwrite its security token, achieving NT AUTHORITY\SYSTEM privileges. The same primitive supports reading kernel memory, leaking secrets such as LSASS contents, BitLocker keys, or hypervisor state. See the GitHub CVE-2024-55414 documentation for the IOCTL details.

Root Cause

The root cause is missing access control and input validation on a privileged kernel interface. The driver exposes a physical memory mapping routine to any process that can open its device object. It does not check the caller's token, restrict the address range to driver-owned buffers, or sanitize the IOCTL parameters before invoking memory mapping APIs.

Attack Vector

Exploitation requires the vulnerable signed driver to be present and loaded. On systems where SmSerl64.sys is already installed, a local user opens a handle to the driver's device object and issues the vulnerable IOCTL with a target physical address. In BYOVD attacks, an adversary with administrative access drops and loads the signed driver, then exploits the IOCTL from any context, including malware loaders, to bypass kernel-mode code integrity and disable endpoint security drivers.

Detection Methods for CVE-2024-55414

Indicators of Compromise

Presence of SmSerl64.sys version 6.12.23.0 on systems that do not require Motorola SM56 modem functionality
Service creation events registering SmSerl64.sys from non-standard paths such as user profile or temp directories
Unexpected CreateFile handles opened against the driver's device namespace from non-administrative processes
Sudden token changes on user processes following DeviceIoControl activity to the driver

Detection Strategies

Monitor Windows event ID 7045 and Sysmon event ID 6 for loads of SmSerl64.sys and correlate with the known vulnerable file hash
Alert on DeviceIoControl calls from medium-integrity processes to driver device objects associated with legacy modem hardware
Hunt for processes that acquire SYSTEM tokens shortly after issuing IOCTLs to third-party drivers
Apply the Microsoft Vulnerable Driver Blocklist and verify it is enforced through HVCI policy

Monitoring Recommendations

Inventory kernel drivers across the fleet and flag instances of SmSerl64.sys that are not tied to active modem hardware
Track kernel driver load telemetry for known BYOVD candidates and feed indicators into the SIEM data lake for retrospective hunts
Enable Attack Surface Reduction rules and Hypervisor-Protected Code Integrity (HVCI) to block unsigned or blocklisted drivers from loading

How to Mitigate CVE-2024-55414

Immediate Actions Required

Uninstall the Motorola SM56 Modem WDM Driver on systems that do not require modem functionality, and remove SmSerl64.sys from disk
Enable the Microsoft Vulnerable Driver Blocklist and verify it covers SmSerl64.sys version 6.12.23.0
Enforce Hypervisor-Protected Code Integrity (HVCI) and Smart App Control where supported to prevent loading of blocklisted signed drivers
Restrict local administrator rights to reduce the population of users who can register kernel drivers

Patch Information

No vendor patch is referenced in the available advisory data. The vulnerability affects Motorola SM56 Modem WDM Driver SmSerl64.sys version 6.12.23.0. Consult Motorola for vendor guidance, and refer to the GitHub CVE-2024-55414 documentation for technical reproduction details.

Workarounds

Block the driver hash through Windows Defender Application Control (WDAC) or AppLocker policies
Add SmSerl64.sys to the Microsoft recommended driver block rules and deploy the policy through Group Policy or Intune
Remove the driver's service registration under HKLM\System\CurrentControlSet\Services and delete the binary from %SystemRoot%\System32\drivers
Restrict access to the driver's device object using ACLs where uninstallation is not yet possible

bash

# Example: deploy Microsoft recommended driver block policy on Windows
citool.exe --update-policy "C:\Windows\Schemas\CodeIntegrity\SiPolicy.p7b" --json
# Verify HVCI and Memory Integrity are enabled
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard