Avast Antivirus Sandbox Vulnerabilities Allow Privilege Escalation

Cybersecurity: Avast Antivirus Vulnerabilities

Research conducted by SAFA has identified four kernel heap overflow vulnerabilities in the aswSnx.sys driver of Avast Antivirus. These vulnerabilities, assigned CVE-2025-13032, affect versions prior to 25.3 on Windows systems.

The identified flaws are due to double-fetch issues in the IOCTL handling process, enabling local attackers to exploit pool overflows to escalate privileges to SYSTEM level. These vulnerabilities necessitate sandbox manipulation to access the attack surface, contrasting with typical sandbox escape scenarios.

SAFA's research targeted Avast due to its extensive deployment and the rich kernel attack surface offered by the user-accessible aswSnx driver, which provides numerous IOCTL handlers under permissive ACLs. The study focused on kernel components that process user-controlled data, prioritizing those with high IOCTL counts for efficient analysis within a time-limited audit.

Reverse engineering indicated shared code across Gendigital products, potentially broadening the impact, although this remains unverified. Manual auditing, combined with heuristics like tracing ProbeForRead calls, identified issues in IOCTL 0x82AC0204, which processes user-supplied UNICODE_STRING structures without properly capturing them in kernel memory.

The driver performs double-fetching of the Length field—once for allocation and again for copying—allowing attackers to alter it mid-operation to cause controlled heap overflows. Similar issues were found in the pString and pData fields, including missing pointer validation that results in Denial of Service (DoS) vulnerabilities.

The aswSnx driver enforces a custom sandbox using snx_lconfig.xml, restricting vulnerable IOCTLs to profiled processes with specific flags. Standard processes lack access, requiring configuration manipulation via IOCTL 0x82AC0054 to register executables under read-only permissions, enabling the creation of a sandboxed exploit.exe to trigger crashes and confirm vulnerabilities.

Additional vulnerabilities were found in the same handler, including loop-based double-fetches on strings for length calculation and allocation, and snprintf misuse during process termination. These lead to user-controlled overflows and DoS through invalid pointers.

Avast addressed these vulnerabilities in version 25.3 by capturing structures to kernel memory, reusing initial lengths, adding size checks against fixed buffers, and validating pointers. The vulnerabilities received a CVSS v3.1 score of 9.9 (Critical) due to their low complexity, low privilege requirements, and full impact on confidentiality, integrity, and availability via scope change.

Organizations are advised to update Avast Antivirus immediately, limit local privileges, and audit logs for escalation attempts. This incident highlights persistent risks in antivirus kernel drivers, even with implemented defenses.

Based on reporting by GBHackers.