CVE-2023-1626
📋 TL;DR
This is a critical local privilege escalation vulnerability in Jianming Antivirus 16.2.2022.418. The vulnerability exists in the kvcore.sys driver's IoControlCode handler where memory corruption can be exploited by local attackers to execute arbitrary code with kernel privileges. Only users of this specific antivirus version are affected.
💻 Affected Systems
- Jianming Antivirus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via kernel-level code execution, allowing attackers to install persistent malware, bypass security controls, and access all system resources.
Likely Case
Local privilege escalation from a standard user account to SYSTEM/administrator privileges, enabling installation of additional malware or credential theft.
If Mitigated
Limited impact if antivirus is patched or removed, though initial compromise would still require local access.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Requires local execution privileges to trigger the vulnerable IoControlCode handler.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check for updates in Jianming Antivirus. 2. If no update is available, consider uninstalling the software. 3. Monitor vendor channels for security updates.
🔧 Temporary Workarounds
Uninstall Jianming Antivirus
windowsRemove the vulnerable software entirely to eliminate the attack surface
Control Panel > Programs > Uninstall a program > Select Jianming Antivirus > Uninstall
Restrict driver loading
windowsPrevent loading of the vulnerable kvcore.sys driver
sc stop jmfw
sc config jmfw start= disabled
🧯 If You Can't Patch
- Implement strict local access controls and user privilege management
- Deploy endpoint detection and response (EDR) solutions to monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check antivirus version in program settings or via 'wmic product get name,version' for Jianming Antivirus version 16.2.2022.418Check Version:
wmic product where "name like '%Jianming%'" get name,versionVerify Fix Applied:
Verify antivirus version is updated beyond 16.2.2022.418 or that the software is completely removed📡 Detection & Monitoring
Log Indicators:
- Unusual driver loading events for kvcore.sys
- Process creation with SYSTEM privileges from user accounts
- Antivirus service crashes or unexpected restarts
Network Indicators:
- No network indicators - purely local exploitation
SIEM Query:
EventID=7045 AND ServiceName="jmfw" OR ProcessName="kvcore.sys"🔗 References
- https://drive.google.com/file/d/1soMFXUAYkCttFDA_icry6q-irb2jdAxw/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/unassigned31
- https://vuldb.com/?ctiid.224008
- https://vuldb.com/?id.224008
- https://drive.google.com/file/d/1soMFXUAYkCttFDA_icry6q-irb2jdAxw/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/unassigned31
- https://vuldb.com/?ctiid.224008
- https://vuldb.com/?id.224008
