CVE-2023-1640
📋 TL;DR
This vulnerability in IObit Malware Fighter's kernel driver allows local attackers to trigger a denial of service condition by sending specially crafted IOCTL requests. It affects users running the vulnerable version of the security software on Windows systems. The attack requires local access to the system.
💻 Affected Systems
- IObit Malware Fighter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
System crash or blue screen (BSOD) requiring reboot, potentially causing data loss or service disruption.
Likely Case
Temporary denial of service affecting the security software or system stability until reboot.
If Mitigated
Minimal impact if proper access controls prevent unauthorized local users from executing code.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Requires local execution privileges but not necessarily administrator rights.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IObit website for latest version (likely 9.4.0.777 or higher)
Vendor Advisory: https://www.iobit.com/en/security.php
Restart Required: Yes
Instructions:
1. Open IObit Malware Fighter. 2. Click 'Check for Updates' in settings. 3. Install available updates. 4. Restart computer.
🔧 Temporary Workarounds
Restrict local user access
windowsLimit local user privileges to prevent unauthorized code execution
Temporarily disable driver
windowsPrevent ObCallbackProcess.sys from loading (may affect software functionality)
sc stop iobitmalwarefighter
sc config iobitmalwarefighter start= disabled
🧯 If You Can't Patch
- Implement strict local access controls and user privilege management
- Monitor for crash dumps or system instability events related to ObCallbackProcess.sys
🔍 How to Verify
Check if Vulnerable:
Check IObit Malware Fighter version in About section or via Programs and FeaturesCheck Version:
wmic product where name="IObit Malware Fighter" get versionVerify Fix Applied:
Verify version is updated beyond 9.4.0.776 and check that ObCallbackProcess.sys driver version has changed📡 Detection & Monitoring
Log Indicators:
- System crash logs (Event ID 41)
- Driver failure events
- Unexpected system reboots
Network Indicators:
- None - local vulnerability only
SIEM Query:
EventID=41 OR Source="System" AND EventID=1001 AND "ObCallbackProcess.sys"🔗 References
- https://drive.google.com/file/d/1AcwSxTA0_zh7mmxU5J8WphRqg_mQsO-g/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1640
- https://vuldb.com/?ctiid.224020
- https://vuldb.com/?id.224020
- https://drive.google.com/file/d/1AcwSxTA0_zh7mmxU5J8WphRqg_mQsO-g/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1640
- https://vuldb.com/?ctiid.224020
- https://vuldb.com/?id.224020
