sandra.sys

sandra.sys is the kernel driver of SiSoftware Sandra, a veteran system-analysis, diagnostics, and benchmarking suite for Windows used by enthusiasts and hardware reviewers. The driver gives the suite low-level hardware access, including model-specific registers, for its probes.

It is on the public record for CVE-2024-34332: SiSoftware Sandra at version 31.66, with SANDRA.sys version 15.18.1.1 and earlier, allowed privilege escalation through a crafted request to the driver, an improper-privilege-management flaw. An older model-specific-register flaw in the Sandra driver, CVE-2010-1592, is also on its record. The driver is legitimately SiSoftware-signed, which is exactly what makes an old build a bring-your-own-vulnerable-driver candidate.

If you run Sandra, update past version 31.66 (SANDRA.sys 15.18.1.1); older signed builds carry the documented escalation. The same file is catalogued in the blocklist under both 'sandra.sys' and a bare 'sandraDriversandraSiSoftware Sandra benchmarking driverOpen plate →' entry, which this guide curates as well.

sandra.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.