PT-2024-19870 · Unknown · Vba32M64.Sys+1

Andres Roldan · Published 2024-02-13 · Updated 2024-10-17 · CVE-2024-23440

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vba32 Antivirus version 3.36.0

Description The issue concerns an Arbitrary Memory Read vulnerability. The 0x22200B IOCTL code of the Vba32m64.sys driver allows reading up to 0x802 of memory from an arbitrary user-supplied pointer.

Recommendations For Vba32 Antivirus version 3.36.0, consider restricting access to the Vba32m64.sys driver to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the 0x22200B IOCTL code in the Vba32m64.sys driver.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-23440

Affected Products

Vba32 Antivirus

Vba32M64.Sys

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-23440 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23440 · Vendor Advisory
• https://twitter.com/fluidattacks/status/1831715914024157439 · Twitter Post
• https://t.me/cvenotify/98520 · Telegram Post
• https://twitter.com/fluidattacks/status/1833559814103798202 · Twitter Post
• https://twitter.com/CVEnew/status/1757422918815105417 · Twitter Post
• https://fluidattacks.com/advisories/adderley · Note
• https://anti-virus.by/vba32 · Note