Researchers Disclose Years-Old Vulnerabilities in Avast and AVG Antivirus

Two high-severity security vulnerabilities, which went
undetected for several years, have been discovered in a legitimate driver^[1]
that’s part of Avast and AVG antivirus solutions.

“These vulnerabilities allow attackers to escalate privileges
enabling them to disable security products, overwrite system
components, corrupt the operating system, or perform malicious
operations unimpeded,” SentinelOne researcher Kasif Dekel said^[2] in a report shared with
The Hacker News.

Tracked as CVE-2022-26522 and CVE-2022-26523, the flaws reside
in a legitimate anti-rootkit kernel driver named aswArPot.sys and
are said to have been introduced in Avast version 12.1, which was
released in June 2016.

Specifically, the shortcomings are rooted in a socket connection
handler in the kernel driver that could lead to privilege
escalation by running code in the kernel from a non-administrator
user, potentially causing the operating system to crash and display
a blue screen of death (BSoD^[3]) error.

Worryingly, the flaws could also be exploited as part of a
second-stage browser attack or to perform a sandbox escape, leading
to far-reaching consequences.

Following responsible disclosure on December 20, 2021, Avast
addressed the issues in version 22.1 of the software released on
February 8, 2022. “Rootkit driver BSoD was fixed,” the company
said^[4]
in its release notes.

While there is no evidence that these flaws were abused in the
wild, the disclosure comes merely days after Trend Micro detailed
an AvosLocker ransomware attack that leveraged^[5]
another issue in the same driver to terminate antivirus solutions
on the compromised system.