IObit Protected Folder IUProcessFilter.sys IOCTL null pointer dereference

# check-CVE-2025-0222.ps1

# Detect likely exposure to CVE-2025-0222 on Windows hosts.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


[CmdletBinding()]
param()

$ErrorActionPreference = 'SilentlyContinue'

function Get-VersionObject {
    param([string]$VersionString)
    try {
        if ([string]::IsNullOrWhiteSpace($VersionString)) { return $null }
        return [version]$VersionString
    } catch {
        return $null
    }
}

function Get-ProtectedFolderInstall {
    $paths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    foreach ($p in $paths) {
        $items = Get-ItemProperty $p | Where-Object {
            $_.DisplayName -match 'Protected Folder' -or $_.DisplayName -match 'IObit Protected Folder'
        }
        foreach ($item in $items) {
            [pscustomobject]@{
                DisplayName = $item.DisplayName
                DisplayVersion = $item.DisplayVersion
                InstallLocation = $item.InstallLocation
                Publisher = $item.Publisher
            }
        }
    }
}

function Get-DriverVersion {
    $candidatePaths = @(
        'C:\Program Files\IObit\Protected Folder\IUProcessFilter.sys',
        'C:\Program Files (x86)\IObit\Protected Folder\IUProcessFilter.sys',
        'C:\Program Files\IObit\Protected Folder\pffilter.sys',
        'C:\Program Files (x86)\IObit\Protected Folder\pffilter.sys'
    )

    foreach ($path in $candidatePaths) {
        if (Test-Path $path) {
            $f = Get-Item $path
            return [pscustomobject]@{
                Path = $path
                FileVersion = $f.VersionInfo.FileVersion
                ProductVersion = $f.VersionInfo.ProductVersion
            }
        }
    }

    return $null
}

$fixedBoundary = Get-VersionObject '13.6.0.5'
$installs = @(Get-ProtectedFolderInstall)
$driver = Get-DriverVersion

if ($installs.Count -eq 0 -and -not $driver) {
    Write-Output 'PATCHED - IObit Protected Folder not detected on this host.'
    exit 0
}

$foundVersion = $null
foreach ($install in $installs) {
    $v = Get-VersionObject $install.DisplayVersion
    if ($v) {
        if (-not $foundVersion -or $v -gt $foundVersion) {
            $foundVersion = $v
        }
    }
}

if (-not $foundVersion -and $driver) {
    $v = Get-VersionObject $driver.ProductVersion
    if (-not $v) { $v = Get-VersionObject $driver.FileVersion }
    if ($v) { $foundVersion = $v }
}

if (-not $foundVersion) {
    Write-Output 'UNKNOWN - Protected Folder artifacts found, but no reliable version could be parsed.'
    if ($driver) { Write-Output ('Driver: ' + $driver.Path) }
    exit 2
}

if ($foundVersion -le $fixedBoundary) {
    Write-Output ('VULNERABLE - Detected Protected Folder version ' + $foundVersion.ToString() + ' (affected range includes 13.6.0.0 through 13.6.0.5).')
    if ($driver) { Write-Output ('Driver: ' + $driver.Path) }
    exit 1
}

Write-Output ('UNKNOWN - Detected version ' + $foundVersion.ToString() + ' which is newer than 13.6.0.5, but no authoritative vendor-fixed version was confirmed in reviewed sources.')
if ($driver) { Write-Output ('Driver: ' + $driver.Path) }
exit 2