Advisory Details

July 29th, 2024

(0Day) Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability

ZDI-24-1004
ZDI-CAN-22963

CVE ID CVE-2024-7232
CVSS SCORE 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS Avast
AFFECTED PRODUCTS Free Antivirus
VULNERABILITY DETAILS

This vulnerability allows local attackers to escalate privileges on affected installations of Avast Free Antivirus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Avast Service. By creating a symbolic link, an attacker can abuse the service to delete a folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.

ADDITIONAL DETAILS

1/03/24 – ZDI reported the vulnerability to Avast’s Security Reports team.
02/12/24 – ZDI asked for updates.
02/23/24 – ZDI asked for updates.
03/15/24 – ZDI informed the vendor that since we’ve not received a response
that we will publish the case as a zero-day advisory on 03/27/24.
04/25/24 – A Gen Digital team member communicated that all the security issues should be submitted via a third-party Vulnerability Disclosure program
05/16/24 – ZDI resubmitted the vulnerability to the third-party Vulnerability Disclosure program
06/19/24 – ZDI asked for updates
07/26/24 – ZDI informed the vendor that since we’ve not received a response that we will publish the case as a zero-day advisory on 07/29/24

-- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application.


DISCLOSURE TIMELINE
  • 2024-05-16 - Vulnerability reported to vendor
  • 2024-07-29 - Coordinated public release of advisory
  • 2024-08-15 - Advisory Updated
CREDIT Nicholas Zubrisky (@NZubrisky) and Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
BACK TO ADVISORIES