CVE-2023-1646
📋 TL;DR
A critical stack-based buffer overflow vulnerability exists in IObit Malware Fighter's IMFCameraProtect.sys driver. Local attackers can exploit this via specific IOCTL calls to potentially execute arbitrary code with kernel privileges. This affects users running IObit Malware Fighter 9.4.0.776 on Windows systems.
💻 Affected Systems
- IObit Malware Fighter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to SYSTEM/kernel level, enabling full system compromise, persistence installation, and bypassing security controls.
Likely Case
Local privilege escalation allowing attackers to gain administrative privileges on compromised systems.
If Mitigated
Limited impact if proper endpoint protection, application control, and least privilege principles are enforced.
🎯 Exploit Status
Exploit code is publicly available; requires local access but no authentication beyond basic user privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version (check IObit website for specific patched version)
Vendor Advisory: https://www.iobit.com/en/security.php
Restart Required: Yes
Instructions:
1. Open IObit Malware Fighter
2. Navigate to Settings > Update
3. Click 'Check for Updates'
4. Install available updates
5. Restart computer
🔧 Temporary Workarounds
Disable vulnerable driver
windowsPrevent loading of the vulnerable IMFCameraProtect.sys driver
sc stop IMFCCameraProtect
sc delete IMFCCameraProtect
Restrict IOCTL access
windowsUse application control policies to block access to vulnerable IOCTL codes
🧯 If You Can't Patch
- Uninstall IObit Malware Fighter 9.4.0.776 completely
- Implement strict application control policies to prevent execution of vulnerable software
🔍 How to Verify
Check if Vulnerable:
Check installed version of IObit Malware Fighter; if version is 9.4.0.776, system is vulnerableCheck Version:
wmic product where name="IObit Malware Fighter" get versionVerify Fix Applied:
Verify IObit Malware Fighter is updated to version newer than 9.4.0.776📡 Detection & Monitoring
Log Indicators:
- Driver load events for IMFCameraProtect.sys
- Process creation with elevated privileges following IOCTL calls
- Security log events showing privilege escalation
Network Indicators:
- No direct network indicators - local exploitation only
SIEM Query:
EventID=4688 AND NewProcessName="*" AND ParentProcessName="*" AND CommandLine="*IObit*"🔗 References
- https://drive.google.com/file/d/1GITWzh29cRcycVqVJgMJuX6emE_f1KPV/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1646
- https://vuldb.com/?ctiid.224026
- https://vuldb.com/?id.224026
- https://drive.google.com/file/d/1GITWzh29cRcycVqVJgMJuX6emE_f1KPV/view
- https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1646
- https://vuldb.com/?ctiid.224026
- https://vuldb.com/?id.224026
