CVE-2021-31727

Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \.\ZemanaAntiMalware, register with the driver using IOCTL 0x80002010 and send these IOCTL's to escalate privileges by overwriting the boot sector or overwriting critical code in the pagefile.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31727.md	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:malwarefox:antimalware:2.74.0.150:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-05-17 13:15

Updated : 2024-02-28 18:28

NVD link : CVE-2021-31727

Mitre link : CVE-2021-31727

CVE.ORG link : CVE-2021-31727

JSON object : View

Products Affected

malwarefox

antimalware

CWE

NVD-CWE-Other

{"id": "CVE-2021-31727", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-05-17T13:15:07.773", "references": [{"url": "https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31727.md", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \\.\\ZemanaAntiMalware, register with the driver using IOCTL 0x80002010 and send these IOCTL's to escalate privileges by overwriting the boot sector or overwriting critical code in the pagefile."}, {"lang": "es", "value": "Un control de acceso incorrecto en las bibliotecas zam64.sys, zam32.sys en MalwareFox AntiMalware versi\u00f3n 2.74.0.150, donde 0x80002014, 0x80002018 de IOCTL exponen capacidades de lectura y escritura de disco sin restricciones, respectivamente. Un proceso no privilegiado puede abrir un identificador para \\.\\ZemanaAntiMalware, registrarse con el controlador usando IOCTL 0x80002010 y enviar estos IOCTL para escalar privilegios sobrescribiendo el sector de arranque o sobrescribiendo el c\u00f3digo cr\u00edtico en el pagefile"}], "lastModified": "2022-07-12T17:42:04.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:malwarefox:antimalware:2.74.0.150:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851453D7-313B-44F0-807C-15C25CCD9AE5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}