PT-2022-6208 · Trend Micro · Trend Micro Maximum Security

Simon Zuckerbraun · Published 2022-12-30 · Updated 2023-01-26 · CVE-2022-48191

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Maximum Security version 17.7

Description A vulnerability exists in Trend Micro Maximum Security wherein a low-privileged user can write a known malicious executable to a specific location. During the removal and restoration process, an attacker could replace an original folder with a mount point to an arbitrary location, allowing for escalation of privileges on an affected system. The issue is related to errors in synchronization when using a shared resource in the Damage Cleanup Engine mechanism of the antivirus protection.

Recommendations For version 17.7, consider restricting access to the Damage Cleanup Engine mechanism to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the shared resource in the Damage Cleanup Engine to prevent potential synchronization errors. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2023-00476

CVE-2022-48191

ZDI-23-053

Affected Products

Trend Micro Maximum Security

References · 6

• https://helpcenter.trendmicro.com/en-us/article/tmka-11252 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48191 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00476 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48191 · Security Note
• https://t.me/cvenotify/42529 · Telegram Post
• https://zerodayinitiative.com/advisories/ZDI-23-053 · Security Note, Patch