CVE-2018-5410
📋 TL;DR
CVE-2018-5410 is a stack-based buffer overflow vulnerability in the Dokan file system driver (dokan1.sys) that allows local attackers to execute arbitrary code with kernel privileges. This affects systems running Dokan versions 1.0.0.5000 through 1.2.0.1000. Attackers can exploit this by creating a device handle to the driver and sending malicious input.
💻 Affected Systems
- Dokan Library
- Dokan File System
📦 What is this software?
Dokany by Dokan Dev
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with kernel-level code execution leading to persistent backdoors, credential theft, and full administrative control.
Likely Case
Local privilege escalation from a standard user account to SYSTEM/administrator privileges, enabling further lateral movement and persistence.
If Mitigated
Limited impact if proper endpoint protection and least privilege principles are enforced, though kernel-level vulnerabilities remain dangerous.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB (ID 46155). Requires local access but exploitation is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.1.1000
Vendor Advisory: https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000
Restart Required: Yes
Instructions:
1. Download Dokan version 1.2.1.1000 or later from official GitHub releases. 2. Uninstall current Dokan version. 3. Install updated version. 4. Restart system to load patched driver.
🔧 Temporary Workarounds
Remove Dokan Driver
windowsUninstall Dokan completely if not required by critical applications
sc stop dokan1
sc delete dokan1
Uninstall via Programs and Features
Restrict Device Access
windowsUse Windows security policies to restrict access to dokan1 device
icacls \\.\dokan1 /deny Everyone:(R,W)
🧯 If You Can't Patch
- Implement strict least privilege principles to limit user access to systems with Dokan installed
- Deploy endpoint detection and response (EDR) solutions to monitor for exploitation attempts and privilege escalation
🔍 How to Verify
Check if Vulnerable:
Check Dokan driver version via Device Manager (System devices -> Dokan Library Bus Enumerator) or registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dokan1Check Version:
reg query "HKLM\SYSTEM\CurrentControlSet\Services\dokan1" /v ImagePathVerify Fix Applied:
Verify Dokan version is 1.2.1.1000 or higher using same methods as checking📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4688 (process creation) showing unusual processes with SYSTEM privileges
- Driver load events for dokan1.sys
Network Indicators:
- Not applicable - local exploitation only
SIEM Query:
EventID=4688 AND NewProcessName="*" AND SubjectUserName!="SYSTEM" AND TokenElevationType="%%1938"🔗 References
- http://www.securityfocus.com/bid/106274
- https://cwe.mitre.org/data/definitions/121.html
- https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000
- https://kb.cert.org/vuls/id/741315/
- https://www.exploit-db.com/exploits/46155/
- http://www.securityfocus.com/bid/106274
- https://cwe.mitre.org/data/definitions/121.html
- https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000
- https://kb.cert.org/vuls/id/741315/
- https://www.exploit-db.com/exploits/46155/
