HN
Today

CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2

This highly technical write-up delves deep into exploiting a double-fetch vulnerability in Avast's kernel driver (CVE-2025-13032) to achieve local privilege escalation on Windows 11. It meticulously details the race condition, heap spray techniques, and complex kernel object manipulation required to turn a memory corruption bug into arbitrary kernel read/write primitives. Such detailed exploit analyses are highly prized on Hacker News for their educational value and insight into advanced cybersecurity techniques.

4
Score
0
Comments
#1
Highest Rank
15h
on Front Page
First Seen
Sep 25, 7:00 AM
Last Seen
Sep 25, 9:00 PM
Rank Over Time
21368791311171616192729

The Lowdown

This post, the second part of a research series, details the full exploitation of CVE-2025-13032, a double-fetch vulnerability found within Avast's kernel driver. The flaw allows for a kernel pool overflow, which the researchers leveraged to achieve local privilege escalation on a fully updated Windows 11 system.

  • The Vulnerability: A double-fetch issue occurs when the Length field of a _UNICODE_STRING is read multiple times during a copy operation. An attacker can modify Length between these reads, causing the ExAllocatePoolWithTag function to allocate a small buffer, while a subsequent memmove operation attempts to copy a much larger amount of data, resulting in a controlled kernel pool overflow.
  • Exploitation Target: The I/O Ring Object's RegBuffers array was chosen as the corruption target. This array, which holds pointers to registered buffers, is in the Paged Pool, its size is user-controlled, and corrupting a single pointer in it is sufficient to gain powerful primitives.
  • Arbitrary Read/Write Primitive: By redirecting a RegBuffers entry to a fake _IOP_MC_BUFFER_ENTRY structure located in userland, the IoRingReadFile and IoRingWriteFile operations can be abused to perform arbitrary kernel writes and reads, respectively. This is possible due to Windows' lack of SMAP (Supervisor Mode Access Prevention).
  • Heap Spray Strategy: A heap spray technique involving allocating and freeing many RegBuffers structures is used to create holes in the Paged Pool. This ensures the overflowing _UNICODE_STRING buffer lands adjacent to a live RegBuffers entry, allowing for reliable corruption.
  • Kernel Address Leak: To proceed, a kernel address (specifically the _EPROCESS address) is required. This is leaked by triggering an IORing operation on the corrupted userland buffer entry, which causes the kernel to create an MDL. The Mdl pointer is then read from the userland entry, and the Process field is extracted from the MDL using the arbitrary read primitive.
  • Crucial Cleanup: Before escalating privileges, the corrupted state must be repaired to prevent system crashes. This involves recalculating and writing back the correct ProcessBilled field in the pool chunk header and managing reference counts for the fake buffer entry to avoid kernel attempts to free userland pointers.
  • Privilege Escalation: With an arbitrary read/write primitive and a kernel address leak, the final step is to steal the SYSTEM process token. This is achieved by walking the _EPROCESS list, reading the SYSTEM process's Token, and then overwriting the current process's Token field with the SYSTEM token.

This intricate exploit demonstrates a sophisticated method for achieving local privilege escalation, highlighting the critical importance of secure memory management and timely patching. Avast has since patched CVE-2025-13032, emphasizing the need for users to keep their software updated.