hexatriene/nuc-winring0-fixPermanent fix for Intel NUC WinRing0 vulnerable driver (CVE-2020-14979) reinstallation via Windows Update
Windows Defender flags OpenHardwareMonitorLib.sys (WinRing0 driver) as VulnerableDriver:WinNT/Winring0 due to CVE-2020-14979. This driver is bundled with Intel's NUC Software Studio service and gets reinstalled via Windows Update.
This repository provides a permanent solution.
performancedriverextension.inf installs NucSoftwareStudioServiceOpenHardwareMonitorLib.sys (WinRing0 kernel driver)Intel Corporation - Extension - 1.0.0.38 keeps reinstalling itThe Intel NUC Performance Driver (ACPI\INTC1036) is an ACPI device that exposes NUC-specific features:
The vulnerable extension hooks into this base driver. Windows Update sees the device and offers driver updates for it.
This disables the ACPI device entirely via Group Policy, preventing any drivers from loading.
Run scripts/disable-device-gpo.ps1 as Administrator, or manually:
# Run as Administrator
.\scripts\disable-device-gpo.ps1
Keeps the base driver but blocks all Windows Update driver installations for this device.
Trade-offs:
Run scripts/block-driver-updates.ps1 as Administrator.
Less permanent - requires re-hiding if Intel releases new versions.
Run scripts/remove-and-hide.ps1 as Administrator.
Check your current status:
.\scripts\diagnose.ps1
| Component | Path |
|---|---|
| Service executable | C:\WINDOWS\System32\DriverStore\FileRepository\performancedriverextension.inf_amd64_*\Service\NucSoftwareStudioService.exe |
| Vulnerable driver | ...\Service\OpenHardwareMonitorLib.sys |
| Base driver inf | oem*.inf (PerformanceDriver) |
| Extension inf | performancedriverextension.inf |
After applying any solution, verify:
# Check service is gone
sc.exe query NucSoftwareStudioService
# Check no pending Intel extension updates
# (Run scripts/diagnose.ps1 for full status)
Scenario: Verify that the Group Policy device block (Option A) survives Windows Update attempting to install the vulnerable driver.
Test procedure:
ACPI\INTC1036 (device disabled)Results after Windows Update installed the package:
| Check | Result |
|---|---|
| NucSoftwareStudioService | Not found (good) |
| Driver store | performancedriverextension.inf staged as oem17.inf |
| OpenHardwareMonitorLib.sys | Not extracted (good) |
| Device INTC1036 | Disabled - GPO held |
| GPO block registry | Active |
Key finding: The GPO device block is the effective protection layer. Windows Update can stage the driver package to the driver store, but it cannot activate because the hardware ID is blocked. The vulnerable .sys file is never extracted or loaded.
After confirming the GPO block held, completed full cleanup:
pnputil /delete-driver oem17.infwushowhide.diagcabFinal verified state:
| Component | Status |
|---|---|
| NucSoftwareStudioService | Not found ✓ |
| Driver store (performancedriverextension.inf) | Clean ✓ |
| OpenHardwareMonitorLib.sys | Not present ✓ |
| Intel NUC Performance Driver device | Disabled ✓ |
| Group Policy device block | Active (INTC1036 blocked) ✓ |
| Intel extension update | Hidden ✓ |
The hardware ID block alone is sufficient protection.
Testing demonstrated that blocking ACPI\INTC1036 via Group Policy prevents the vulnerable driver from ever loading, even when Windows Update successfully downloads and stages the driver package. The service executable and .sys file are never extracted because the target device is disabled.
Recommended minimal configuration:
ACPI\INTC1036 — This is the only required protectionThe simplicity of this approach is its strength: a single registry-based device block provides complete protection without interfering with normal Windows Update functionality for other devices.
When the Intel NUC Performance Driver device (ACPI\INTC1036) is disabled:
No longer available:
Still works normally:
Why this is acceptable for most users: The NUC Performance Driver primarily enables software customization of fan/LED behavior. The BIOS provides default profiles that work without any Windows driver. Most users set fan curves once in BIOS and never touch them again. If you require dynamic Windows-based fan control (e.g., gaming profiles that switch automatically), Option A may not be suitable—consider Option B instead.
# Remove the Group Policy block
Remove-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" -Recurse -Force
# Re-enable the device
$device = Get-PnpDevice | Where-Object { $_.InstanceId -like '*INTC1036*' }
Enable-PnpDevice -InstanceId $device.InstanceId -Confirm:$false
Remove-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions" -Recurse -Force
If you have additional findings or improvements, please open an issue or PR.
MIT License - Use at your own risk. Always verify scripts before running as Administrator.