CVE-2018-16719
📋 TL;DR
This vulnerability in Jingyun Antivirus allows local users to trigger a denial of service (BSOD) or potentially execute arbitrary code by sending malformed input to a specific IOCTL in the driver. It affects users of Jingyun Antivirus version 2.4.2.39 on Windows systems where the antivirus is installed.
💻 Affected Systems
- Jingyun Antivirus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise through arbitrary code execution in kernel mode.
Likely Case
Local denial of service causing system crashes (BSOD) disrupting antivirus protection and system stability.
If Mitigated
Limited to denial of service if exploit attempts are blocked by security controls, but antivirus functionality remains impaired.
🎯 Exploit Status
Public proof-of-concept code exists demonstrating BSOD trigger. Weaponization for code execution would require additional exploit development but is feasible given the nature of the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or replacing with alternative antivirus solution.
🔧 Temporary Workarounds
Disable vulnerable driver
windowsPrevent loading of the vulnerable hookbody.sys driver
sc stop JingYunHook
sc config JingYunHook start= disabled
Restrict access to driver device
windowsModify ACLs to restrict which users can access the vulnerable driver
icacls \\.\JingYunHook /deny *S-1-1-0:(R)
🧯 If You Can't Patch
- Implement strict local user privilege separation to limit who can execute code on affected systems
- Deploy application whitelisting to prevent unauthorized programs from interacting with the vulnerable driver
🔍 How to Verify
Check if Vulnerable:
Check if hookbody.sys driver version 2.4.2.39 is loaded: driverquery | findstr hookbodyCheck Version:
wmic datafile where name='C:\\Program Files\\Jingyun Antivirus\\hookbody.sys' get versionVerify Fix Applied:
Verify the driver is no longer loaded or has been updated to a newer version📡 Detection & Monitoring
Log Indicators:
- System crash logs (BSOD) with hookbody.sys mentioned in stack trace
- Event logs showing driver loading/unloading
Network Indicators:
- No network indicators - this is a local vulnerability
SIEM Query:
EventID=1001 AND Source='BugCheck' AND Description LIKE '%hookbody.sys%'