Alwil Software Avast Antivirus Device Driver Memory Overwrite Vulnerability by Piotr Bania http://pb.specialised.info Original location: http://pb.specialised.info/all/adv/avast-adv.txt Severity: Less Critical/Medium - local ring0 code execution Software affected: Probably all versions of Avast Antivirus, however tested with 4.6v. I have contacted Alwil Software and the bug is patched within the new version (released few days ago). I. BACKGROUND Avast Antivirus is very common antivirus software package with a big worldwide userbase. (more details on: http://www.avast.com) II. DESCRIPTION The vulnerability is caused by no bounds checking procedure in the device driver. By sending special signal(s) together with specially crafted input buffer attacker can force Avast Asynchronous Virus Monitor to overwrite specified memory with data provided by the attacker. Here is the one of vulnerable codes: (DISASSEMBLY OF Aavmker4 DEVICE DRIVER) ----// SNIP SNIP //------------------------------------------------- .text:00010901 loc_10901: ; CODE XREF: sub_10604+2A8j .text:00010901 mov eax, [ebx+0Ch] ; eax=input buffer .text:00010904 xor edx, edx ; edx=0 .text:00010906 mov [ebp+var_8], eax; store .text:00010909 cmp [eax], edx ; input buffer == 0? .text:0001090B jz short loc_10966 ; if so -> exit .text:0001090D mov edi, [eax+870h] ; edi=addres from input buffer+870h .text:00010913 lea esi, [eax+4] ; esi=ptr to input buffer+4 .text:00010916 mov ecx, 21Ah ; ecx=21Ah size to copy (const) .text:0001091B rep movsd ; copy ----// SNIP SNIP //------------------------------------------------- Sending the input buffer written below: ----// SNIP SNIP //------------------------------------------------- input_buff: db "YOU!" db 86Ch dup (90h) ; source memory (ESI) dd 1234567h ; destination address db "GONDIE" ----// SNIP SNIP //------------------------------------------------- forces Avast device driver to write data from "source memory" to destination address (here 1234567h). III. IMPACT Successful exploitation may allow attacker to obtain full system control (ring0 priviledges), if the attack fails the operating system will fault. IV. POC CODE Poc code was released for this issue.