# Signed drivers with known vulnerabilities, often left behind by hardware
# tools. Pitstop looks for these files in the loaded driver list and in
# C:\Windows\System32\drivers, then names the tool that installed them.
#
# `status`:
#   "vanguard_blocks"     Vanguard refuses to let this driver load.
#   "microsoft_blocklist" On Microsoft's recommended driver block list.
#                         We don't claim Vanguard blocks it.

[[driver]]
file = "WinRing0x64.sys"
cve = "CVE-2020-14979"
status = "vanguard_blocks"
shipped_by = "Older fan-control, RGB and overclocking tools"
fix = "Update the tool that installed it to a version without WinRing0, or uninstall it."
source = "https://nvd.nist.gov/vuln/detail/CVE-2020-14979"

[[driver]]
file = "RTCore64.sys"
cve = "CVE-2019-16098"
status = "microsoft_blocklist"
shipped_by = "Older versions of MSI Afterburner"
fix = "Update MSI Afterburner, or uninstall it."
source = "https://learn.microsoft.com/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules"