evga_kernel_driver-x64.sys

evga_kernel_driver-x64.sys is a kernel driver from EVGA Precision X1, EVGA's GPU overclocking and monitoring utility and a direct peer to MSI Afterburner. It provides the low-level hardware access the app uses to monitor and tune the graphics card.

It is on the public record for CVE-2020-14979, found and disclosed by researcher Matt Hand. The underlying vulnerable component was the bundled WinRing0 driver (curated in this guide as winring0x64.sysDriverwinring0x64.sysOpen-source hardware monitoring driver (the 'OEM glue' driver)Open plate →), which created its device with no access restriction, so any local user could reach it and escalate to SYSTEM. EVGA fixed it in Precision X1 1.0.7 by shipping replacement drivers with a proper security descriptor.

This is a clean example of the WinRing0 problem the guide already documents: the same open-source monitoring driver is embedded, under many names, in MSI Afterburner, HWiNFO, OpenRGB, and others, and Microsoft tracks the family as a vulnerable driver. If you use EVGA Precision X1, update to 1.0.7 or later; the older signed build hands SYSTEM to any local process.

evga_kernel_driver-x64.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.