CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2
2 hours ago
- CVE-2025-13032 is a double-fetch vulnerability in Avast's kernel driver that leads to a controlled paged pool overflow.
- The exploit targets the RegBuffers array of the I/O Ring object, turning a single corrupted pointer into an arbitrary kernel read/write primitive.
- A heap spray strategy with LFH allocation is used to position the overflowing buffer adjacent to a live RegBuffers allocation.
- A kernel address leak is achieved by reading the MDL pointer from a fake _IOP_MC_BUFFER_ENTRY and then dereferencing it to obtain the _EPROCESS address.
- Repairs are needed to avoid a blue screen: fixing the ProcessBilled field in the pool chunk header and releasing the RegBuffers registration after increasing the reference count.
- Privilege escalation to SYSTEM is completed by stealing the SYSTEM process token via arbitrary read/write on the EPROCESS structure.