CVE-2023-1644
📋 TL;DR
This vulnerability in IObit Malware Fighter's IMFCameraProtect.sys driver allows local attackers to trigger a denial of service through improper IOCTL handling. Attackers with local access can crash the system or cause instability. Only users of IObit Malware Fighter 9.4.0.776 are affected.
💻 Affected Systems
- IObit Malware Fighter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker causes complete system crash or kernel panic requiring hard reboot, potentially leading to data loss or corruption.
Likely Case
Local user or malware causes application/service crash, disrupting security protection temporarily.
If Mitigated
With proper access controls, only authorized users could trigger the DoS, limiting impact to legitimate users.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Requires local access to execute. The vulnerability is in a kernel driver, making exploitation straightforward for local users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IObit for updated version beyond 9.4.0.776
Vendor Advisory: Not provided in references, check IObit official website
Restart Required: Yes
Instructions:
1. Open IObit Malware Fighter. 2. Check for updates in settings. 3. Install latest version. 4. Restart computer to ensure new driver loads.
🔧 Temporary Workarounds
Disable or remove vulnerable driver
windowsTemporarily disable or unload the IMFCameraProtect.sys driver
sc stop IMFProtect
sc delete IMFProtect
Restrict access to device
windowsSet restrictive permissions on the driver device object
icacls \\.\IMFProtect /deny Everyone:(R,W)
🧯 If You Can't Patch
- Implement strict local access controls to prevent unauthorized users from running arbitrary code
- Monitor for attempts to load or interact with IMFCameraProtect.sys driver
🔍 How to Verify
Check if Vulnerable:
Check if IMFCameraProtect.sys driver version 9.4.0.776 is loaded: driverquery | findstr IMFCameraProtectCheck Version:
Check IObit Malware Fighter version in program interface or via registry: reg query "HKLM\SOFTWARE\IObit\IObit Malware Fighter" /v VersionVerify Fix Applied:
Verify driver version is updated or driver is not loaded: driverquery | findstr IMFCameraProtect📡 Detection & Monitoring
Log Indicators:
- System crashes or blue screens
- Event ID 41 (Kernel-Power) with bugcheck code
- Driver load failures for IMFCameraProtect.sys
Network Indicators:
- None - local vulnerability only
SIEM Query:
EventID=41 OR (Source="System" AND EventID=7026 AND "IMFCameraProtect")🔗 References
- https://drive.google.com/file/d/1TVezyDiS9Kyw7ttNlLBCstpEUqxozha0/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1644
- https://vuldb.com/?ctiid.224024
- https://vuldb.com/?id.224024
- https://drive.google.com/file/d/1TVezyDiS9Kyw7ttNlLBCstpEUqxozha0/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1644
- https://vuldb.com/?ctiid.224024
- https://vuldb.com/?id.224024
