Vba32 Antivirus v3.36.0 - DoS
5.5
Medium
Discovered by

Offensive Team, Fluid Attacks
Summary
Full name
Vba32 Antivirus v3.36.0 - Denial of Service (DoS)
Code name
State
Public
Release date
Jan 29, 2024
Affected product
Vba32 Antivirus
Vendor
VirusBlokAda
Affected version(s)
Version 3.36.0
Vulnerability name
Denial of Service (DoS)
Vulnerability type
Remotely exploitable
No
CVSS v3.0 vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v3.0 base score
5.5
Exploit available
Yes
CVE ID(s)
Description
Vba32 Antivirus v3.36.0 is vulnerable to a Denial of Service vulnerability by triggering the 0x2220A7 IOCTL code of the Vba32m64.sys driver.
Vulnerability
The 0x2220A7 IOCTL code of the Vba32m64.sys
driver is vulnerable to DoS, leading to a BSOD of the affected computer caused by a NULL pointer dereference. If an attacker sends an nOutBufferSize
parameter greater or equal than 0x2E, the execution flow will reach the function sub_11B34
which doesn't verify the return address of another routine:
At [1], the return value is assigned to a variable which is then dereferenced at [2] without checking for its value, leading to a NULL pointer dereference:
Our security policy
We have reserved the ID CVE-2024-23441 to refer to this issue from now on.
System Information
Version: Vba32 Antivirus v3.36.0
Operating System: Windows
Mitigation
There is currently no patch available for this vulnerability.
References
Vendor page https://www.anti-virus.by/
Product page https://www.anti-virus.by/vba32
Timeline
Vulnerability discovered
Jan 16, 2024
Vendor contacted
Jan 16, 2024
Vendor replied
Jan 18, 2024
Public disclosure
Jan 29, 2024