Twister Antivirus v8.17 - DoS

Description

Twister Antivirus v8.17 is vulnerable to a Denial of Service vulnerability by triggering the 0x80112067, 0x801120CB 0x801120CC 0x80112044, 0x8011204B, 0x8011204F, 0x80112057, 0x8011205B, 0x8011205F, 0x80112063, 0x8011206F, 0x80112073, 0x80112077, 0x80112078, 0x8011207C and 0x80112080 IOCTL codes of the fildds.sys driver.

Vulnerability

The 0x80112067, 0x801120CB 0x801120CC 0x80112044, 0x8011204B, 0x8011204F, 0x80112057, 0x8011205B, 0x8011205F, 0x80112063, 0x8011206F, 0x80112073, 0x80112077, 0x80112078, 0x8011207C and 0x80112080 IOCTL code of the fildds.sys driver allows to perform a Denial of Service, leading to a BSOD of the affected computer caused by a NULL pointer dereference.

The resulting debugging session when triggering those IOCTLs resemble the following:

rax=0000000000000000 rbx=ffffce8e6d6fa060 rcx=fffff80171540000
rdx=0000000000000000 rsi=0000000000000001 rdi=ffffce8e6ea8f140
rip=fffff80171541994 rsp=fffff0056a289ee0 rbp=0000000000000002
 r8=0000000000000000  r9=0000000000000000 r10=fffff80171542cd0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=ffffce8e6ea8f140 r15=ffffce8e6dbaada0
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050286
fildds+0x1994:
fffff801`71541994 8b8000040000    mov     eax,dword ptr [rax+400h] ds:002b:00000000`00000400=????????
Resetting default scope

PROCESS_NAME:  IOCTLBruteForce.exe

STACK_TEXT:
fffff005`6a289ee0 fffff801`71542e65     : ffffce8e`80112080 00000000`00000000 ffffce8e`00000000 00000000`00000000 : fildds+0x1994
fffff005`6a28b780 fffff801`6aed1f35     : ffffce8e`6dbaada0 ffffce8e`6d6fa060 fffff005`6a28bb80 00000000`00000001 : fildds+0x2e65

Our security policy

We have reserved the ID CVE-2024-1096 to refer to this issue from now on.

Disclosure policy

System Information

• Version: Twister Antivirus v8.17

• Operating System: Windows

Mitigation

There is currently no patch available for this vulnerability.

References

• Vendor page http://www.filseclab.com/en-us/index.htm

• Product page http://www.filseclab.com/en-us/products/twister.htm