CVE-2023-1639
📋 TL;DR
This vulnerability in IObit Malware Fighter's kernel driver allows local attackers to trigger a denial of service condition through a specific IOCTL call. It affects users running the vulnerable version of the security software on Windows systems. The attack requires local access to the system.
💻 Affected Systems
- IObit Malware Fighter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
System crash or blue screen (BSOD) requiring reboot, potentially causing data loss or service disruption.
Likely Case
Application or system instability leading to temporary denial of service for the affected security software.
If Mitigated
Minimal impact if proper access controls prevent unauthorized local users from executing the exploit.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Attack requires local user access to execute the IOCTL call.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IObit for updated version beyond 9.4.0.776
Vendor Advisory: Not specified in provided references
Restart Required: Yes
Instructions:
1. Open IObit Malware Fighter. 2. Check for updates in settings. 3. Install latest version. 4. Restart system to ensure new driver loads.
🔧 Temporary Workarounds
Disable or uninstall IObit Malware Fighter
windowsRemove the vulnerable software component entirely
Control Panel > Programs > Uninstall IObit Malware Fighter
Restrict access to vulnerable driver
windowsUse Windows security policies to restrict who can interact with the driver
🧯 If You Can't Patch
- Implement strict local access controls to prevent unauthorized users from running arbitrary code
- Monitor for crash dumps or system instability events related to ImfRegistryFilter.sys
🔍 How to Verify
Check if Vulnerable:
Check IObit Malware Fighter version in About section or verify ImfRegistryFilter.sys driver versionCheck Version:
wmic product where name="IObit Malware Fighter" get versionVerify Fix Applied:
Confirm updated version is installed and check that exploit no longer causes system issues📡 Detection & Monitoring
Log Indicators:
- System crash logs (Event ID 41)
- Driver failure events
- Unexpected system reboots
Network Indicators:
- None - local vulnerability only
SIEM Query:
EventID=41 OR Source="System" AND EventID=1001 OR ProcessName="IObitMalwareFighter.exe" AND EventID=1000🔗 References
- https://drive.google.com/file/d/1hWgHhboaekq4hGIj2kNgEI54rM-u_rvV/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1639
- https://vuldb.com/?ctiid.224019
- https://vuldb.com/?id.224019
- https://drive.google.com/file/d/1hWgHhboaekq4hGIj2kNgEI54rM-u_rvV/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1639
- https://vuldb.com/?ctiid.224019
- https://vuldb.com/?id.224019
