CVE-2025-13032: Entering and Breaking the Avast Antivirus Sandbox Part 2
This highly technical write-up delves deep into exploiting a double-fetch vulnerability in Avast's kernel driver (CVE-2025-13032) to achieve local privilege escalation on Windows 11. It meticulously details the race condition, heap spray techniques, and complex kernel object manipulation required to turn a memory corruption bug into arbitrary kernel read/write primitives. Such detailed exploit analyses are highly prized on Hacker News for their educational value and insight into advanced cybersecurity techniques.
The Lowdown
This post, the second part of a research series, details the full exploitation of CVE-2025-13032, a double-fetch vulnerability found within Avast's kernel driver. The flaw allows for a kernel pool overflow, which the researchers leveraged to achieve local privilege escalation on a fully updated Windows 11 system.
- The Vulnerability: A double-fetch issue occurs when the
Lengthfield of a_UNICODE_STRINGis read multiple times during a copy operation. An attacker can modifyLengthbetween these reads, causing theExAllocatePoolWithTagfunction to allocate a small buffer, while a subsequentmemmoveoperation attempts to copy a much larger amount of data, resulting in a controlled kernel pool overflow. - Exploitation Target: The I/O Ring Object's
RegBuffersarray was chosen as the corruption target. This array, which holds pointers to registered buffers, is in the Paged Pool, its size is user-controlled, and corrupting a single pointer in it is sufficient to gain powerful primitives. - Arbitrary Read/Write Primitive: By redirecting a
RegBuffersentry to a fake_IOP_MC_BUFFER_ENTRYstructure located in userland, theIoRingReadFileandIoRingWriteFileoperations can be abused to perform arbitrary kernel writes and reads, respectively. This is possible due to Windows' lack of SMAP (Supervisor Mode Access Prevention). - Heap Spray Strategy: A heap spray technique involving allocating and freeing many
RegBuffersstructures is used to create holes in the Paged Pool. This ensures the overflowing_UNICODE_STRINGbuffer lands adjacent to a liveRegBuffersentry, allowing for reliable corruption. - Kernel Address Leak: To proceed, a kernel address (specifically the
_EPROCESSaddress) is required. This is leaked by triggering an IORing operation on the corrupted userland buffer entry, which causes the kernel to create an MDL. TheMdlpointer is then read from the userland entry, and theProcessfield is extracted from the MDL using the arbitrary read primitive. - Crucial Cleanup: Before escalating privileges, the corrupted state must be repaired to prevent system crashes. This involves recalculating and writing back the correct
ProcessBilledfield in the pool chunk header and managing reference counts for the fake buffer entry to avoid kernel attempts to free userland pointers. - Privilege Escalation: With an arbitrary read/write primitive and a kernel address leak, the final step is to steal the SYSTEM process token. This is achieved by walking the
_EPROCESSlist, reading the SYSTEM process'sToken, and then overwriting the current process'sTokenfield with the SYSTEM token.
This intricate exploit demonstrates a sophisticated method for achieving local privilege escalation, highlighting the critical importance of secure memory management and timely patching. Avast has since patched CVE-2025-13032, emphasizing the need for users to keep their software updated.