CVE-2023-1642
📋 TL;DR
A local denial-of-service vulnerability exists in IObit Malware Fighter's kernel driver ObCallbackProcess.sys. Attackers with local access can trigger a system crash via specific IOCTL calls. Only users of IObit Malware Fighter 9.4.0.776 are affected.
💻 Affected Systems
- IObit Malware Fighter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash/BSOD requiring physical reboot, potentially causing data loss or service disruption.
Likely Case
Local user or malware causes system instability or temporary denial of service on affected machines.
If Mitigated
Limited impact due to local-only access requirement and availability of patches/workarounds.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Requires local user access but no special privileges. The vulnerability is in a kernel driver, making exploitation straightforward for local attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest IObit Malware Fighter version (check vendor for specific fixed version)
Vendor Advisory: https://www.iobit.com/en/malware-fighter.php
Restart Required: Yes
Instructions:
1. Open IObit Malware Fighter. 2. Check for updates in settings. 3. Install available updates. 4. Restart computer to ensure new driver loads.
🔧 Temporary Workarounds
Disable or uninstall IObit Malware Fighter
windowsRemove the vulnerable software component entirely
Control Panel > Programs > Uninstall IObit Malware Fighter
Restrict access to vulnerable driver
windowsUse application control or driver block policies to prevent loading of ObCallbackProcess.sys
🧯 If You Can't Patch
- Implement strict local access controls and privilege separation
- Monitor for suspicious local process activity and driver loading events
🔍 How to Verify
Check if Vulnerable:
Check IObit Malware Fighter version in About section or Programs list. Version 9.4.0.776 is vulnerable.Check Version:
wmic product where name="IObit Malware Fighter" get versionVerify Fix Applied:
Verify IObit Malware Fighter version is updated beyond 9.4.0.776 and check driver file version of ObCallbackProcess.sys.📡 Detection & Monitoring
Log Indicators:
- System crash/BSOD events
- Driver load failures for ObCallbackProcess.sys
- Unexpected IOCTL calls to vulnerable driver
Network Indicators:
- None - local-only vulnerability
SIEM Query:
EventID=41 OR (DriverName="ObCallbackProcess.sys" AND EventID=219)🔗 References
- https://drive.google.com/file/d/1iWdqJ9PsBp1W5xINpUdQ28xbx_tB9xxf/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1642
- https://vuldb.com/?ctiid.224022
- https://vuldb.com/?id.224022
- https://drive.google.com/file/d/1iWdqJ9PsBp1W5xINpUdQ28xbx_tB9xxf/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1642
- https://vuldb.com/?ctiid.224022
- https://vuldb.com/?id.224022
