CVE-2009-3522

Avast! 4.8.1351.0 AntiVirus - 'aswMon2.sys' Kernel Memory Corruption

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-3522 has a selected CVSS score of 7.2; EIP currently links 1 catalogued exploit.

Description

Stack-based buffer overflow in aswMon2.sys in avast! Home and Professional for Windows 4.8.1351, and possibly other versions before 4.8.1356, allows local users to cause a denial of service (system crash) and possibly gain privileges via a crafted IOCTL request to IOCTL 0xb2c80018.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBAvast! 4.8.1351.0 AntiVirus - 'aswMon2.sys' Kernel Memory CorruptionExploitDB exploitby GiuseppeExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a C program that triggers a stack-based buffer overflow in the Avast! antivirus driver aswMon2.sys by sending a crafted IOCTL request. It allocates a buffer filled with 'A' characters and passes it to the driver via DeviceIoControl, which is intended to cause a denial of service (system crash) and potentially lead to privilege escalation.

Backdoor review

No backdoor observed in reviewed code

The provided C source code is a straightforward proof-of-concept (PoC) for a local denial-of-service (DoS) vulnerability in Avast! antivirus (payload withheld). It opens the vulnerable device driver 'aswMon2.sys' and sends a crafted IOCTL request to trigger a kernel memory corruption, leading to a system crash. The code contains no hidden or secondary payloads, no network callbacks, no file writes, and no obfuscation. The author's comment 'payload withheld' explicitly states the code is for DoS only and does not include privilege escalation. The code's behavior is fully explained by the stated exploit purpose.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesC
Target softwareAvast! Home and Professional for Windows 4.8.1351.0aswMon2.sys
Attack typesdosprivilege_escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively sends a crafted input to a vulnerable driver to trigger a buffer overflow, which is the definition of an exploit. The author's comment 'payload withheld' implies the code is intended to demonstrate the vulnerability in a way that could be extended to privilege escalation, but the provided code itself performs the exploitation action.

exploits/windows/dos/10106.c:11exploits/windows/dos/10106.c:69-70

Requirements

  • Local access to a Windows system with the vulnerable Avast! driver installed.exploits/windows/dos/10106.c:1-6

Observed behavior

  • Opens a handle to the device 'aswMon' using CreateFileW.exploits/windows/dos/10106.c:37-39
  • Allocates a buffer of 0x288 bytes filled with 'A' characters.exploits/windows/dos/10106.c:63-68
  • Sends the buffer to the driver via DeviceIoControl with IOCTL code payload withheld.exploits/windows/dos/10106.c:69-70
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Exploit
Payload withheldThe code targets a known stack-based buffer overflow in aswMon2.sys via IOCTL payload withheld, consistent with the CVE description.exploits/windows/dos/10106.c:1-3
Ioctl Code
Payload withheldThe IOCTL code used to trigger the vulnerability in the Avast driver.exploits/windows/dos/10106.c:69
Author Comment
Payload withheldAuthor explicitly states the code does not include a privilege escalation payload.exploits/windows/dos/10106.c:11
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the provided source code; no dynamic execution or verification of the exploit's effectiveness was performed.
  • The code is labeled as a denial-of-service (DOS) exploit, but the CVE description indicates potential for privilege escalation, which is not demonstrated in the code.
  • Review is based solely on the provided source code; no binary analysis was performed.
  • The code is a local DoS PoC and does not include any remote access or persistence mechanisms, but the review cannot guarantee the absence of such behavior if the code were compiled and executed in a specific environment.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

11