CVE-2023-1631
📋 TL;DR
This vulnerability in JiangMin Antivirus allows local attackers to trigger a null pointer dereference in the kernel driver kvcore.sys via a specific IOCTL call. This can cause system crashes (blue screen) or potentially be leveraged for denial of service. Only users running the affected antivirus software on Windows systems are impacted.
💻 Affected Systems
- JiangMin Antivirus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Kernel crash leading to system instability, denial of service, or potential local privilege escalation if combined with other vulnerabilities.
Likely Case
System crash (blue screen) causing temporary denial of service on the affected machine.
If Mitigated
Minimal impact with proper access controls preventing local attackers from executing malicious code.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Requires local execution privileges to trigger the IOCTL call.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Check JiangMin Antivirus vendor website for security updates. Update to the latest version if available.
🔧 Temporary Workarounds
Restrict access to kvcore.sys driver
windowsApply access control lists to limit which users/processes can interact with the vulnerable driver
icacls "C:\Windows\System32\drivers\kvcore.sys" /deny *S-1-1-0:(RX)
Disable or uninstall JiangMin Antivirus
windowsRemove the vulnerable software if not essential for operations
appwiz.cpl
🧯 If You Can't Patch
- Implement strict local access controls and privilege separation
- Monitor for crash dumps or system instability events related to kvcore.sys
🔍 How to Verify
Check if Vulnerable:
Check JiangMin Antivirus version in program settings or via 'wmic product get name,version'Check Version:
wmic product where "name like 'JiangMin%'" get name,versionVerify Fix Applied:
Verify antivirus version is updated beyond 16.2.2022.418📡 Detection & Monitoring
Log Indicators:
- System crash events (Event ID 41)
- Driver fault errors related to kvcore.sys
- Unexpected system reboots
Network Indicators:
- None - local vulnerability only
SIEM Query:
EventID=41 OR Source="System" AND EventID=1001 AND "kvcore.sys"🔗 References
- https://drive.google.com/file/d/1Div9mElTdsluLrU2etziLYqmXcqQFj1j/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1631
- https://vuldb.com/?ctiid.224013
- https://vuldb.com/?id.224013
- https://drive.google.com/file/d/1Div9mElTdsluLrU2etziLYqmXcqQFj1j/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1631
- https://vuldb.com/?ctiid.224013
- https://vuldb.com/?id.224013
