CVE-2018-16723
📋 TL;DR
This vulnerability in Jingyun Antivirus allows local users to trigger a denial of service (BSOD) or potentially execute arbitrary code by sending malformed input to a specific IOCTL in the driver. It affects users of Jingyun Antivirus version 2.4.2.39 on Windows systems.
💻 Affected Systems
- Jingyun Antivirus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise via arbitrary code execution in kernel mode.
Likely Case
Denial of service (system crash/BSOD) disrupting antivirus protection and system stability.
If Mitigated
Limited to denial of service if proper input validation is implemented.
🎯 Exploit Status
Exploit requires local user access. Public proof-of-concept demonstrates BSOD trigger via IOCTL 0x12364020.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or switching to alternative antivirus software.
🔧 Temporary Workarounds
Disable or Remove Vulnerable Driver
windowsPrevent loading of the vulnerable ZySandbox.sys driver
sc stop ZySandbox
sc delete ZySandbox
Remove or rename ZySandbox.sys from system directories
Restrict Driver Access
windowsUse application control policies to block execution of the vulnerable driver
Configure Windows Defender Application Control or AppLocker to block ZySandbox.sys
🧯 If You Can't Patch
- Remove Jingyun Antivirus and replace with updated alternative antivirus solution
- Implement strict access controls to limit local user privileges on affected systems
🔍 How to Verify
Check if Vulnerable:
Check if ZySandbox.sys driver is present and version 2.4.2.39 of Jingyun Antivirus is installedCheck Version:
Check antivirus software version in program settings or via 'wmic product get name,version'Verify Fix Applied:
Verify ZySandbox.sys driver is not loaded or has been removed from system📡 Detection & Monitoring
Log Indicators:
- System crash/BSOD events in Windows Event Logs
- Driver load failures for ZySandbox.sys
Network Indicators:
- Local IOCTL calls to driver with code 0x12364020
SIEM Query:
EventID=41 OR (Source='System' AND EventID=7036 AND Message LIKE '%ZySandbox%')