Vulnerabilities In Avast And AVG Put Millions At Risk - SentinelOne.pdf

Summary:

SentinelLabs discovered two critical flaws (CVE-2022-26522 and CVE-2022-26523) in Avast and AVG's "Anti Rootkit" driver, affecting millions of users worldwide. These vulnerabilities enable attackers to escalate privileges, disrupt security products, overwrite system components, corrupt the operating system, or perform malicious operations.

Impact:

- Potential Exploitation: The vulnerabilities can be exploited from sandboxes and might be used in various contexts, including second-stage browser attacks or sandbox escapes.
- Device Takeover: Due to kernel-mode code execution capabilities, these flaws could lead to complete device takeover even without administrator privileges.
- Bypassing Security Products: Attackers may use these vulnerabilities to bypass security products like Avast and AVG.

Mitigation:

- Avast has released patches (version 22.1) automatically for most users.
- Air-gapped or on-premise installations are advised to apply the patch immediately.

Statistics:

- Millions of users worldwide potentially affected.
- Similar vulnerabilities in other products remained hidden for up to 12 years.

Action Required:

SentinelLabs disclosed these issues to Avast in December 2021, and while there's no evidence of in-the-wild abuse yet, users are advised to take prompt action to patch their systems.

Conclusion:

These vulnerabilities highlight the importance of proactive security measures and timely patching. SentinelLabs' disclosure aims to assist customers and the community in understanding the risk and taking necessary actions.