CVE-2021-44968
📋 TL;DR
This CVE describes a Use-After-Free vulnerability in IOBit Advanced SystemCare 15 Pro's kernel driver. Attackers can exploit it by sending specific IOCTL requests in sequence, potentially leading to arbitrary code execution with kernel privileges or system crashes. Users running the vulnerable software are affected.
💻 Affected Systems
- IOBit Advanced SystemCare 15 Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains kernel-level code execution, enabling complete system compromise, persistence, and bypass of security controls.
Likely Case
Local privilege escalation from standard user to SYSTEM/root, or denial of service causing system instability/crash.
If Mitigated
Attack fails due to lack of local access or security software blocking driver exploitation.
🎯 Exploit Status
Exploit requires local access and knowledge of specific IOCTL sequences; public research available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - Check IOBit updates for Advanced SystemCare 15 Pro
Vendor Advisory: Not provided in CVE
Restart Required: Yes
Instructions:
1. Open Advanced SystemCare 15 Pro. 2. Check for updates in settings. 3. Install latest version. 4. Restart computer.
🔧 Temporary Workarounds
Disable or remove driver
windowsUninstall Advanced SystemCare or disable its kernel driver to prevent exploitation.
sc stop iobitdriver
sc delete iobitdriver
Restrict driver access
windowsUse application control policies to block execution of vulnerable driver.
🧯 If You Can't Patch
- Restrict local user access to systems running vulnerable software
- Monitor for suspicious driver activity using EDR/sysmon
🔍 How to Verify
Check if Vulnerable:
Check if Advanced SystemCare 15 Pro is installed and driver loaded (e.g., driver query tools or check installed programs).Check Version:
Check program version in Advanced SystemCare settings or Windows Programs list.Verify Fix Applied:
Verify updated version is installed and driver version changed.📡 Detection & Monitoring
Log Indicators:
- Driver load events for iobit driver
- Unusual IOCTL requests to driver
- System crash logs
Network Indicators:
- Not network exploitable
SIEM Query:
EventID=7045 ServiceName contains 'iobit' OR Driver load events with iobit signature