CVE-2020-12122
📋 TL;DR
This vulnerability in Max Secure Max Spyware Detector allows local users to send malicious input via IOCtl 0x2200019 to the MaxProc64.sys driver, causing a denial of service (BSOD) or potentially other impacts due to improper input validation. It affects users of Max Secure Max Spyware Detector 1.0.0.044 and potentially other Max Secure products that include the vulnerable driver.
💻 Affected Systems
- Max Secure Max Spyware Detector
- Other Max Secure products that include MaxProc64.sys
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, arbitrary code execution in kernel context, or persistent denial of service.
Likely Case
Local denial of service (BSOD) causing system instability and potential data loss from unsaved work.
If Mitigated
Limited to denial of service with proper user access controls preventing unauthorized local access.
🎯 Exploit Status
Public exploit code is available on GitHub, making exploitation straightforward for attackers with local access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.maxpcsecure.com/spywaredetector.htm
Restart Required: Yes
Instructions:
1. Check vendor website for updated version. 2. Uninstall vulnerable version. 3. Install patched version if available. 4. Restart system.
🔧 Temporary Workarounds
Remove vulnerable driver
windowsUninstall Max Secure Max Spyware Detector to remove the vulnerable MaxProc64.sys driver
Control Panel > Programs and Features > Uninstall Max Secure Max Spyware Detector
Restrict driver access
windowsUse Windows security policies to restrict access to the vulnerable driver
sc stop MaxProc64
sc config MaxProc64 start= disabled
🧯 If You Can't Patch
- Implement strict local access controls to prevent unauthorized users from running code on affected systems
- Monitor for unexpected system crashes or BSOD events that could indicate exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if MaxProc64.sys driver exists in system32\drivers and verify software version is 1.0.0.044 or earlierCheck Version:
Check installed programs in Control Panel or examine file properties of MaxProc64.sysVerify Fix Applied:
Verify MaxProc64.sys driver is removed or software is updated to a version later than 1.0.0.044📡 Detection & Monitoring
Log Indicators:
- System crash logs (BSOD) with references to MaxProc64.sys
- Unexpected driver load events
- Failed IOCtl operations
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
EventID=41 OR (Source="System" AND EventID=1001) AND "MaxProc64" OR DriverName="MaxProc64.sys"🔗 References
- https://github.com/FULLSHADE/Kernel-exploits
- https://github.com/FULLSHADE/Kernel-exploits/tree/master/MaxProc64.sys
- https://www.maxpcsecure.com/spywaredetector.htm
- https://github.com/FULLSHADE/Kernel-exploits
- https://github.com/FULLSHADE/Kernel-exploits/tree/master/MaxProc64.sys
- https://www.maxpcsecure.com/spywaredetector.htm
