citmdrv_amd64.sys

IBM Tivoli Common Inventory Technology driver

From IBM

Part of the IBM family

Status

On a known-vulnerable list

Known variants

16 distinct hashes

Field notes

citmdrv_amd64.sys is the AMD64 build of the kernel driver from IBM Tivoli's Common Inventory Technology, an enterprise asset-management agent. Its job in the legitimate context is collecting hardware and software inventory from network endpoints.

It is on the LOLDrivers list because its IOCTL surface gives a local caller kernel-level privilege-escalation primitives. It is not something a typical gaming PC would have; its appearance is normally on machines managed by a corporate IT department.

If you find it on a personal system, the most likely explanation is that the system was previously enrolled in a corporate asset-management deployment.

What the record shows

citmdrv_amd64.sys is listed as a known-vulnerable driver on the public LOLDrivers project. 16 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.

What this means, plainly

Presence is not proof of misuse. Driver files on the LOLDrivers list commonly ship with legitimate hardware tools, gaming software, or vendor utilities. Their presence is recorded as evidence on a record. It is never treated as a verdict about a person.

Related drivers

Other drivers in the IBM family. See the whole family →

citmdrv_ia64.sys

Source

Status data comes from the public LOLDrivers project, a community-curated registry of drivers known to be vulnerable or malicious. The snapshot Vera uses was refreshed July 10, 2026. CVE links go to the NIST National Vulnerability Database.

In plain words

Kernel driver BYOVD Ring 0 Code-signing certificate Certificate revocation The full glossary →

Cite this entry

Vera Project. “citmdrv_amd64.sys.” Vera Field Guide (Driver). The Vera Project. https://www.veraproject.xyz/field-guide/drivers/citmdrv-amd64-sys