Procexp152.sys can't be loaded

[petermorlion]

Describe the bug

I installed RabbitMQ 3.12.10 via the Windows installer and also tried 3.12.9 via Chocolatey. In both cases I see get an error message from Windows when the I enable the management plugin: A driver cannot load on this device. Specifically, the procexp152.sys driver:

I get these popups constantly, one over the other.

I've search the internet and the driver is linked to Process Explorer, which I don't have on my PC. I tried installing the latest version of Process Explorer because the internet tells me the latest version has an updated driver. To no avail.

Reproduction steps

1. Install RabbitMQ on Windows
2. Enable the management plugin

This might be specific to my PC of course. Also, Core Isolation feature in Windows Security is on.

Expected behavior

No popups about risky drivers.

Additional context

No response

[michaelklishin]

@petermorlion procexp152.sys is not something that ship with RabbitMQ or Erlang. In fact, RabbitMQ does not have any Windows-specific or OS-specific code.

[michaelklishin]

A quick search suggests that procexp152.sys is a driver that is installed under C:\Windows\System32\drivers. RabbitMQ Windows installer certainly does not install anything to that location.

Here are just a few threads where all kinds of security tools flag this driver:

• One
• Two
• Three
• Four

There aren't any specific details as to what the vulnerabilities in the driver are but none of the
threads "install RabbitMQ" as one of the steps. It is not something that RabbitMQ installs or uses.

Some users in one of the threads above delete that driver and the issue goes away. What kind of software can be affected by this "solution", I don't know. Please do your own research.

[petermorlion]

As I said "This might be specific to my PC of course" and with respect, I did do research. But I thought to ask here to be sure it wasn't RabbitMQ doing anything specific. Now I know I should dig deeper and elsewhere. Thank you for the clarification.