PT-2021-7811 · Malwarefox · Malwarefox Antimalware

Published 2021-05-09 · Updated 2022-07-12 · CVE-2021-31727

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MalwareFox AntiMalware version 2.74.0.150

Description The issue is related to incorrect access control in the zam64.sys and zam32.sys drivers of MalwareFox AntiMalware, allowing a non-privileged process to escalate privileges. This can be achieved by opening a handle to .ZemanaAntiMalware, registering with the driver using IOCTL 0x80002010, and then sending specific IOCTLs (0x80002014 and 0x80002018) that expose unrestricted disk read/write capabilities. An attacker can exploit this to overwrite the boot sector or critical code in the pagefile, thus gaining elevated privileges.

Recommendations For MalwareFox AntiMalware version 2.74.0.150, consider disabling the IOCTL 0x80002010 registration functionality and restrict access to the zam64.sys and zam32.sys drivers as a temporary workaround to minimize the risk of exploitation. Additionally, avoid using the IOCTLs 0x80002014 and 0x80002018 in the affected driver until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2023-03026

CVE-2021-31727

Affected Products

Malwarefox Antimalware

References · 6

• 🔥 https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31727.md · Exploit
• 🔥 https://github.com/irql0/CVE-2021-31728 · Exploit
• https://bdu.fstec.ru/vul/2023-03026 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31727 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31727 · Security Note
• https://t.me/cybersecuritytechnologies/3325 · Telegram Post