Entering and Breaking the Avast Antivirus Sandbox Part 2
Exploitation of CVE-2025-13032 in Avast Antivirus demonstrates how a kernel double-fetch vulnerability leads to arbitrary read/write and local privilege escalation.
read it Provides a clear, end-to-end breakdown of a real-world kernel exploit chain from heap overflow to token theft.
summary
This writeup details the full exploitation of CVE-2025-13032, a double-fetch vulnerability in an Avast Antivirus kernel driver. The authors leverage a paged pool overflow to corrupt the RegBuffers array of an IORing object, achieving an arbitrary kernel read/write primitive. They leak an _EPROCESS pointer via MDL introspection, repair pool headers to prevent blue screens during teardown, and finalize local privilege escalation by stealing the SYSTEM process token.
key points
- A double-fetch vulnerability allows a race condition where the kernel allocates a small buffer via ExAllocatePoolWithTag but copies a larger user-controlled size via memmove.
- Corrupting the RegBuffers pointer array of an IORing object redirects I/O operations to a user-controlled fake buffer entry, creating an arbitrary kernel read/write primitive.
- The exploit leaks the target _EPROCESS address by inspecting the Mdl field attached to the corrupted buffer entry and repairs the pool chunk header to prevent crashes on teardown.
who should read it
Security researchers, kernel developers, and engineers interested in Windows internals and vulnerability exploitation.
discussion skeptical
consensus
Commenters largely bypass the technical details of the exploit to debate the broader security value of antivirus software, with many arguing that modern AVs increase attack surface and advocating for application whitelisting instead.
pushback
Some point out that application whitelisting is impractical for general users or enterprise deployment at scale, while others defend AV as a necessary safety net against untrained employees.
That's an impressively tight TOCTOU exploit!
Acknowledges the technical elegance of the tight TOCTOU exploit mechanism used in the bug.
Generated by an LLM from the article and thread. Check the sources before relying on it.