PT-2023-32308 · Avast · Avg/Avast Antivirus

Published 2023-11-08 · Updated 2023-11-16 · CVE-2023-5760

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avast/Avg Antivirus version 23.8

Description A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests leads to an out-of-bounds write vulnerability. This can be further exploited, allowing an attacker to gain full local privilege escalation on the system.

Recommendations For Avast/Avg Antivirus version 23.8, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2023-5760

Affected Products

Avg/Avast Antivirus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-5760 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5760 · Vendor Advisory
• https://support.norton.com/sp/static/external/tools/security-advisories.html · Note
• https://twitter.com/VulmonFeeds/status/1722344270735032442 · Twitter Post
• https://twitter.com/vuldb/status/1722593013904572540 · Twitter Post
• https://twitter.com/CVEnew/status/1722296156657512956 · Twitter Post