CVE-2018-6593

Vulnerability

The vulnerability resides in the kernel drivers zam32.sys and zam64.sys of MalwareFox AntiMalware version 2.74.0.150. The driver creates a filter communication port at \\.\ZemanaAntiMalware but fails to set a proper Discretionary Access Control List (DACL). Instead of using the default security descriptor that restricts access to SYSTEM and Administrators, the driver calls RtlSetDaclSecurityDescriptor with a NULL DACL pointer, granting all users (including unprivileged processes) the ability to connect to the port [1].

Exploitation

An attacker with local access to the system, even as a non-privileged user, can connect to the filter communication port using the FilterConnectCommunicationPort API. Once connected, the driver automatically registers the connecting process as trusted. The attacker can then send the IOCTL code 0x8000204C to the device \\.\ZemanaAntiMalware to request privilege escalation. The exploit code provided in the reference demonstrates this sequence [1].

Impact

Successful exploitation allows an attacker to elevate privileges from a non-privileged process to SYSTEM level. With elevated privileges, the attacker can disable real-time protection, write to raw disk, open full access handles to arbitrary processes, and perform other high-privilege operations, effectively compromising the entire system [1].

Mitigation

As of the publication date (February 2018), no official patch or fixed version has been disclosed by MalwareFox. Users are advised to update to a newer version if available, or consider removing the software if no update is provided. The vulnerability is listed in the Exploit Database (EDB-ID 43973) and may be targeted by malware [1].