CVE-2018-16721
📋 TL;DR
This vulnerability in Jingyun Antivirus allows local users to trigger a denial of service (BSOD) or potentially execute arbitrary code by sending malformed input to a driver's IOCTL handler. It affects users of Jingyun Antivirus version 2.4.2.39 on Windows systems. The issue stems from improper input validation in the ZySandbox.sys driver.
💻 Affected Systems
- Jingyun Antivirus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, arbitrary code execution with kernel privileges, or persistent denial of service.
Likely Case
Local denial of service (Blue Screen of Death) causing system instability and requiring reboot.
If Mitigated
Limited to denial of service if exploit attempts are blocked by security controls, with no privilege escalation.
🎯 Exploit Status
Proof-of-concept code is publicly available on GitHub. Exploitation requires local access but no authentication beyond standard user privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check vendor website for updated version. 2. Uninstall vulnerable version. 3. Install latest version if available. 4. Reboot system.
🔧 Temporary Workarounds
Disable or remove vulnerable driver
windowsPrevent loading of the vulnerable ZySandbox.sys driver
sc stop ZySandbox
sc delete ZySandbox
Restrict driver access permissions
windowsSet restrictive ACLs on the driver to prevent unauthorized access
icacls C:\Windows\System32\drivers\ZySandbox.sys /deny *S-1-1-0:(RX)
🧯 If You Can't Patch
- Uninstall Jingyun Antivirus and replace with alternative security software
- Implement strict access controls to prevent local users from executing arbitrary code
🔍 How to Verify
Check if Vulnerable:
Check if ZySandbox.sys driver version 2.4.2.39 is present in C:\Windows\System32\drivers\Check Version:
driverquery /v | findstr ZySandboxVerify Fix Applied:
Verify ZySandbox.sys driver is either removed or updated to a newer version📡 Detection & Monitoring
Log Indicators:
- System crashes (Event ID 41)
- Driver load failures for ZySandbox.sys
- Access denied errors for driver operations
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
EventID=41 AND Source="Microsoft-Windows-Kernel-Power" | where Description contains "BSOD"