{"id":122999,"date":"2025-03-25T22:22:55","date_gmt":"2025-03-25T20:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/windows-defender-blokiruet-svobodnyj-drajver-winring0-ispolzuemyj-v-oficzialnom-oem-po"},"modified":"2025-03-25T22:22:55","modified_gmt":"2025-03-25T20:22:55","slug":"windows-defender-blokiruet-svobodnyj-drajver-winring0-ispolzuemyj-v-oficzialnom-oem-po","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/windows-defender-blokiruet-svobodnyj-drajver-winring0-ispolzuemyj-v-oficzialnom-oem-po","title":{"rendered":"Windows Defender blocks the free WinRing0 driver used in official OEM software.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Starting March 11, the built-in Windows antivirus package Windows Defender began blocking (quarantining) the free WinRing0 driver. This driver is used to access various hardware from user space for which no other API is provided in the system. <\/p>\n
The WinRing0 driver is in demand in projects managing hardware settings, both open-source (OpenRGB, Libre Hardware Monitor, FanControl) and proprietary (SignalRGB, Razer Synapse 3). Among the software utilizing the driver are official programs from dozens of hardware manufacturers, including popular ones. It is worth noting that the driver was self-signed by the author (the developer of CrystalDiskMark) and accepted by Microsoft. <\/p>\n
The issue noted by Microsoft that led to the block is related to the fact that any program can access the driver installed in the system, and through the driver, a program can manipulate any device in the system or elevate its privileges (CVE-2020-14979). <\/p>\n
In light of the imposed block, many companies were forced to react. For example, SignalRGB transitioned to using its own proprietary replacement, while Steelseries completely disabled the functionality for displaying system metrics on the built-in screens of their hardware in their software. <\/p>\n
Currently, a fix has been released for WinRing0 that restricts driver usage only to programs run with administrator rights; however, due to changes in Microsoft's policy regarding drivers, obtaining a signature for the new build is challenging. <\/p>\n
Chinese company HYTE, which develops software for monitoring hardware (HYTE Nexus), where this driver is also used, has volunteered to handle the bureaucratic procedure and announced that it will publish a signed build for free use. Nevertheless, even if Microsoft accepts the updated driver, many programs for managing hardware settings and monitoring will need to be run with admin rights or adapted to work with the modified driver. <\/p>\n