CVE-2021-31728

Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook with IOCTL 0x80002044 and execute the executable memory using this hook with IOCTL 0x80002014 or 0x80002018, this exposes ring 0 code execution in the context of the driver allowing the non-privileged process to elevate privileges.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31728.md	Third Party Advisory
https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31728.md	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:malwarefox:antimalware:2.74.0.150:*:*:*:*:*:*:*

History

21 Nov 2024, 06:06

Type	Values Removed	Values Added
References	~~() https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31728.md - Third Party Advisory~~	() https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31728.md - Third Party Advisory

Information

Published : 2021-05-17 13:15

Updated : 2024-11-21 06:06

NVD link : CVE-2021-31728

Mitre link : CVE-2021-31728

CVE.ORG link : CVE-2021-31728

JSON object : View

Products Affected

malwarefox

antimalware

CWE

NVD-CWE-Other

{"id": "CVE-2021-31728", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-05-17T13:15:07.803", "references": [{"url": "https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31728.md", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/irql0/CVE-2021-31728/blob/master/CVE-2021-31728.md", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \\.\\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook with IOCTL 0x80002044 and execute the executable memory using this hook with IOCTL 0x80002014 or 0x80002018, this exposes ring 0 code execution in the context of the driver allowing the non-privileged process to elevate privileges."}, {"lang": "es", "value": "Un control de acceso incorrecto en las bibliotecas zam64.sys, zam32.sys en MalwareFox AntiMalware versi\u00f3n 2.74.0.150, permite que un proceso no privilegiado abra un identificador para \\.\\ZemanaAntiMalware, se registre con el controlador mediante el env\u00edo de IOCTL 0x80002010, asigne memoria ejecutable usando un fallo en IOCTL 0x80002040, instale un hook con IOCTL 0x80002044 y ejecute la memoria ejecutable usando este hook con IOCTL 0x80002014 o 0x80002018, esto expone la ejecuci\u00f3n del c\u00f3digo del anillo 0 en el contexto del controlador, permitiendo que al proceso no privilegiado elevar privilegios"}], "lastModified": "2024-11-21T06:06:09.627", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:malwarefox:antimalware:2.74.0.150:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851453D7-313B-44F0-807C-15C25CCD9AE5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}