CVE-2025-0288: Paragon Backup Privilege Escalation Flaw

CVE-2025-0288 Overview

CVE-2025-0288 is an arbitrary kernel memory write vulnerability in biontdrv.sys, a kernel driver shipped with multiple Paragon Software products in the Hard Disk Manager product line. The driver's use of memmove does not validate or sanitize user-controlled input, allowing a local attacker to write arbitrary data to kernel memory. Successful exploitation enables privilege escalation from a low-privileged user to SYSTEM on Windows. Because biontdrv.sys is a signed driver, attackers can also abuse it through Bring Your Own Vulnerable Driver (BYOVD) techniques on systems where Paragon software is not installed.

Critical Impact
A local attacker with low privileges can write arbitrary kernel memory through biontdrv.sys and escalate to SYSTEM, fully compromising confidentiality, integrity, and availability of the host.

Affected Products

Paragon Backup & Recovery
Paragon Hard Disk Manager
Paragon Partition Manager, Drive Copy, Disk Wiper, and Migrate OS to SSD

Discovery Timeline

2025-03-03 - CVE-2025-0288 published to the National Vulnerability Database
2025-06-25 - Last updated in NVD database

Technical Details for CVE-2025-0288

Vulnerability Analysis

The flaw resides in biontdrv.sys, the kernel-mode driver bundled with Paragon Software's Hard Disk Manager product line. The driver exposes an IOCTL interface that user-mode processes can call to perform disk management operations. One of the handlers invokes memmove using parameters derived from the caller's input buffer without validating destination addresses, source pointers, or copy length. As a result, an attacker who can open a handle to the driver can direct memmove to write attacker-controlled data into arbitrary kernel virtual addresses. This primitive is sufficient to corrupt kernel structures such as token objects, callback tables, or page table entries, granting SYSTEM privileges on the local host. CERT/CC tracks this issue under VU#726882, which catalogs five related Paragon driver vulnerabilities.

Root Cause

The root cause is missing input validation in the IOCTL handler that calls memmove. The driver trusts user-supplied pointers and length values, violating the kernel-mode rule that all input crossing the user/kernel boundary must be probed and bounds-checked. NVD classifies the weakness as NVD-CWE-noinfo, but it is functionally an arbitrary kernel write driven by improper input validation.

Attack Vector

Exploitation requires local access and the ability to execute code as a standard user. The attacker opens a handle to the biontdrv.sys device object and issues a crafted DeviceIoControl request containing the target kernel address and payload bytes. Because the driver is Microsoft-signed, threat actors can stage biontdrv.sys on unaffected systems and load it themselves in a BYOVD attack to bypass endpoint controls. No user interaction is needed beyond running the exploit binary.

No public proof-of-concept exploit code has been published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog at this time. Technical details are described in the Paragon Software security patch advisory and the CERT/CC vulnerability note.

Detection Methods for CVE-2025-0288

Indicators of Compromise

Presence of biontdrv.sys on hosts where Paragon Software is not legitimately installed, indicating possible BYOVD staging.
Unexpected service or driver load events referencing biontdrv.sys initiated by non-Paragon parent processes.
New SYSTEM-level processes spawned shortly after a user-mode process opens a handle to the Paragon driver device object.

Detection Strategies

Hunt for kernel driver loads of biontdrv.sys with file versions older than the patched build, correlating against installed Paragon product versions.
Detect anomalous DeviceIoControl activity targeting the Paragon driver from processes that are not signed Paragon binaries.
Monitor for token manipulation patterns, such as a medium-integrity process suddenly executing with a SYSTEM token, immediately following driver interaction.

Monitoring Recommendations

Enable Windows Sysmon Event ID 6 (driver loaded) and forward to a SIEM with rules matching the vulnerable biontdrv.sys hashes published by CERT/CC.
Track Microsoft's Vulnerable Driver Blocklist updates and alert when blocked driver load attempts occur.
Audit privileged process creation events (Event ID 4688) and correlate with prior driver IOCTL activity from the same session.

How to Mitigate CVE-2025-0288

Immediate Actions Required

Update all Paragon Hard Disk Manager product line installations to the patched driver version released by Paragon Software.
Enable the Microsoft Vulnerable Driver Blocklist on Windows 10, Windows 11, and Windows Server to block the vulnerable biontdrv.sys from loading.
Inventory endpoints for the presence of biontdrv.sys and remove stale copies left behind by uninstalled Paragon products.

Patch Information

Paragon Software has released an updated biontdrv.sys driver addressing this and related issues. Refer to the Paragon Driver Security Patch advisory and the Paragon Software patches overview for the full list of fixed product versions and download instructions.

Workarounds

If patching is not immediately possible, uninstall affected Paragon products and delete biontdrv.sys from %SystemRoot%\System32\drivers\.
Enforce Windows Defender Application Control (WDAC) policies that block loading of unsigned or known-vulnerable driver hashes.
Restrict local administrative rights to reduce the population of accounts capable of staging BYOVD attacks.

bash

# Enable the Microsoft Vulnerable Driver Blocklist via PowerShell (Windows 11 22H2+)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f

# Verify the driver is not present on non-Paragon systems
Get-ChildItem -Path C:\Windows\System32\drivers\ -Filter biontdrv.sys -ErrorAction SilentlyContinue