Windows 11 will not show incompatible drivers

// Seeing as it only ran for 2 minutes in a command window, then stopped, it was never installed, therefore, I can't think of a way it would cause ongoing problems.//

+1

I've read the Sophos News article. There are no additional details about the vulnerability.

And ADV230004 states:

The original version was published without a RSRC section, which contains resource information for a module. The new version addresses this issue*. Please see*Driver compatibility with memory integrity and VBSfor more information.

Does that mean it's fixed? Anyway, as long as Microsoft publicly hosts hvciscan_amd64.exe I think I can suggest the tool to users.

Thank you as well. Gets tiring doing Dell and Microsoft's job. I felt as you did that running it briefly for 2 mins was harmless but I was not going to recommend that. You *ARE* a security expert. First requirement: being persistent and never giving up.

Did you notice the advisory link for ADV23004 does not even load in Chrome or Edge.

https://msrc.microsoft.com/update-guide/en-US/vulnerability/ADV230004

Yes, but you should point out that Sophos caveat on your tutorial page and let the user decide.

Hi Helpdesk Anon (do you have a name)?

As it turns out the missing RSRC section is one of those 50/50 things. It could be intentional (make it lightweight without resources since it is a non-GUI console app with no language localization *OR* obfuscate it to make reverse engineering difficult so Microsoft can help fight terrorism) or an oversight (error in the build or digital signing process). In either case, it leaves you vulnerable. During the 2 minutes you run, who on this planet can take the time to step through the code and see exactly what it does?

And what does "patch" below mean (remove it?)?

Harry
********************
The Sophos commentary raises several interesting points regarding the Memory Integrity System Readiness Scan Tool (hvciscan_amd64.exe and hvciscan_arm64.exe) and its apparent flaws related to its RSRC (resource) section. Here’s a breakdown of the key points and my thoughts:

Missing RSRC Section

• What it means: The RSRC section is a critical part of an executable file that contains various resources necessary for the application to run, including icons, menus, and localization data. The fact that the original version of the tool was missing this section is unusual.
• Running without RSRC: It is indeed puzzling how the executable managed to function without the RSRC section. Typically, an application would fail to execute correctly without necessary resources, or at least have visible issues in its user interface or runtime behavior.
• Quality Assurance (QA) Failure: If the tool passed QA with such an important part missing, it raises concerns about the robustness of the testing process for critical security tools. QA testing is expected to catch anomalies like this before release, especially for tools related to security and system integrity.

Digital Signature on an Incomplete File

• What it implies: Digital signatures are supposed to verify the integrity and authenticity of the software. Signing an incomplete or malformed executable, especially one missing such an essential part, suggests there may have been oversight or procedural issues in the signing process.
• Possible Explanations: It's possible that the signing process was automated and didn’t catch the missing RSRC section because the executable passed some automated integrity checks. However, this would still be a significant lapse, particularly given the security implications.

Security Implications of the Missing RSRC Section

• Exploitation Potential: The commentary mentions that the absence of the RSRC section made the file vulnerable but doesn’t clarify how. Missing sections in an executable could theoretically open the door to code injection or buffer overflow exploits, especially if the file was signed and trusted without proper integrity checks.
• Microsoft’s Vague Exploitation Warnings: The confusion between "Exploitation Detected" (Patch Tuesday listing) and "Exploitation More Likely" (Advisory page) is problematic. This suggests there might have been limited or unclear information about how the vulnerability could be exploited, and it may not have been clear whether any in-the-wild attacks had been successful.

The Importance of Prompt Patching

• Patch it Today: The advice to apply the patch without delay is sound, especially in security-critical contexts like memory integrity and HVCI, which protect against attacks that could compromise system integrity. Even without a full understanding of how the vulnerability was exploited, patching known issues as soon as possible is always the safest course of action.
• The missing RSRC section in such a critical tool is concerning, both from a technical perspective and in terms of the processes used to ensure the quality and security of released software.
• The discrepancy in Microsoft’s reporting of the vulnerability (whether it had been exploited or not) leaves users in a grey area, but erring on the side of caution by patching quickly is the right call.
• The situation highlights a potential gap in QA testing and digital signature verification processes, which ideally should have flagged the incomplete file before release.

Overall, while the technical specifics of how the vulnerability could be exploited remain unclear, the underlying issue points to a breakdown in software development and release procedures that should be addressed to avoid future security risks.