v153: inpoutx64.sys is getting blocked by Riot Vanguard

[ArbiterGR]

Describe the bug
By updating to 153, i got a notification by Riot Vanguard, that it blocked the loading of inpoutx64.sys:

Vanguard seems to block this driver because it is prone to privilege escalation vulnerability. This is effectively the same issue happening with OpenRGB, but its developer is refusing to do anything about it.

More info on the vulnerability here

I unticked inpout in the settings, but maybe you should reconsider using this driver.

[Diztiler]

I can confirm receiving the same Warning message from Riot Vanguard anticheat after updating to v153.

[Rem0o]

There isn't a lot of kernel drivers available. Most projects you'll see on Github with kernel level functions will use the same 2-3, probably like OpenRGB. I know this one can cause problems, hence why I made it optional. Using it enables some functionality, but it is not mandatory.

[venomized]

I can confirm I am getting this as well.

[venomized]

I get this popup every time i open my pc how can i uninstall fancontrol?

[ArbiterGR]

There isn't a lot of kernel drivers available. Most projects you'll see on Github with kernel level functions will use the same 2-3, probably like OpenRGB. I know this one can cause problems, hence why I made it optional. Using it enables some functionality, but it is not mandatory.

I can understand that, but having a kernel driver that is insecure and prone to exploitation can pose a risk, that i personally would not take even if it means loss of functionality. But i can see the appeal.

In the latest release notes, you state that you enabled it by default. May i suggest to revert this change and make it optional by default? Also, The driver should only be installed when you enable the inpOut option and unload it when you untick the option.

For anyone is looking to remove the driver (and stop Vanguard from complaining), Untick Inpout support in fancontrol and delete the following File followed by a reboot:
C:\Windows\System32\Drivers\inpoutx64.sys

[venomized]

There isn't a lot of kernel drivers available. Most projects you'll see on Github with kernel level functions will use the same 2-3, probably like OpenRGB. I know this one can cause problems, hence why I made it optional. Using it enables some functionality, but it is not mandatory.

I can understand that, but having a kernel driver that is insecure and prone to exploitation can pose a risk, that i personally would not take even if it means loss of functionality. But i can see the appeal.

In the latest release notes, you state that you enabled it by default. May i suggest to revert this change and make it optional by default? Also, The driver should only be installed when you enable the inpOut option and unload it when you untick the option.

For anyone is looking to remove the driver (and stop Vanguard from complaining), Untick Inpout support in fancontrol and delete the following File followed by a reboot: C:\Windows\System32\Drivers\inpoutx64.sys

Where is the option to unload I don't see it.

[Rem0o]

Sensor settings, top right menu. I wasn't sure about the default for the setting. It's always a compromise. In hindsight I think disabled by default is the right call. Will switch it.

[Darkolas091]

There isn't a lot of kernel drivers available. Most projects you'll see on Github with kernel level functions will use the same 2-3, probably like OpenRGB. I know this one can cause problems, hence why I made it optional. Using it enables some functionality, but it is not mandatory.

I can understand that, but having a kernel driver that is insecure and prone to exploitation can pose a risk, that i personally would not take even if it means loss of functionality. But i can see the appeal.

In the latest release notes, you state that you enabled it by default. May i suggest to revert this change and make it optional by default? Also, The driver should only be installed when you enable the inpOut option and unload it when you untick the option.

For anyone is looking to remove the driver (and stop Vanguard from complaining), Untick Inpout support in fancontrol and delete the following File followed by a reboot: C:\Windows\System32\Drivers\inpoutx64.sys

This has worked for me. Thank you.

[vinsh3nt]

There isn't a lot of kernel drivers available. Most projects you'll see on Github with kernel level functions will use the same 2-3, probably like OpenRGB. I know this one can cause problems, hence why I made it optional. Using it enables some functionality, but it is not mandatory.

I can understand that, but having a kernel driver that is insecure and prone to exploitation can pose a risk, that i personally would not take even if it means loss of functionality. But i can see the appeal.

In the latest release notes, you state that you enabled it by default. May i suggest to revert this change and make it optional by default? Also, The driver should only be installed when you enable the inpOut option and unload it when you untick the option.

For anyone is looking to remove the driver (and stop Vanguard from complaining), Untick Inpout support in fancontrol and delete the following File followed by a reboot: C:\Windows\System32\Drivers\inpoutx64.sys

Vanguard is still giving me the warning after removing the file from the Drivers directory. Is there some kind of cleanup step I'm missing?

[Still34]

There isn't a lot of kernel drivers available. Most projects you'll see on Github with kernel level functions will use the same 2-3, probably like OpenRGB. I know this one can cause problems, hence why I made it optional. Using it enables some functionality, but it is not mandatory.

This is a terrible choice and should be frowned upon. Not only is this reckless, it is also extremely irresponsible to not let the users know beforehand, especially that you had the knowledge for it. Using a known vulnerable driver can easily allow third-parties to interact with system-level stuff from userland. If you do not have a proper workaround for it, don't just pick up a driver that you found on the side of the road and expect it to be trustworthy. As a security researcher, I had to immediately go into IR mode and track down whatever was causing the driver to load. I cannot believe I had to find out by Defender warning me and me going out of my way to search for this specific driver on an issue page buried on GitHub.

For those that are concerned, Defender also has the driver listed in the vulnerable driver block list. Deleting the driver and restarting should now result in Defender blocking the driver from loading if you have vulnerable driver block list enabled.

[Rem0o]

@Still34 The driver itself (InpOutx64) was part of LHM for a long time, which is used as a backend. However it had basically no use for FanControl, so I turned if off by reflection since the beginning. Recently they (LHM repo) added some new feature for gigabyte 2nd IO chip, which uses that driver. Thus I added a checkbox to toggle on/off the deactivation I had by default before, which allows the new feature to work.

When I said "can cause problem", I meant being blocked by various anti-cheats. I don't know the exact security threat being referenced here. If you got a link or something, I could add a little warning symbol next to the option and link it.

[Still34]

Sure, the driver is in the list of known vulnerable drivers, which allows privileged users to access kernel-land. You can find a list of them here. Alternatively, see Defender's recommended block list.

[Rem0o]

@Still34 I guess the microsoft one seems more legit, but it kinda doesn't tell what the threat is, just that it is recommended to be blocked.

[Still34]

@Still34 I guess the microsoft one seems more legit, but it kinda doesn't tell what the threat is, just that it is recommended to be blocked.

As I've said, it allows for privileged users to gain control of the kernel driver and load in their own and or worse. The most simple way for you to test this is through something like KDU, which also supports the inpoutx64 driver.