CVE-2023-5760
📋 TL;DR
A time-of-check to time-of-use (TOCTOU) vulnerability in Avast/AVG Antivirus allows local attackers to perform out-of-bounds writes through IOCTL requests, leading to privilege escalation. This affects users running Avast/AVG Antivirus version 23.8 on their systems.
💻 Affected Systems
- Avast Antivirus
- AVG Antivirus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full local privilege escalation allowing an attacker to gain SYSTEM/root-level access and completely compromise the host.
Likely Case
Local privilege escalation from a standard user account to administrator/root privileges.
If Mitigated
Limited impact if antivirus is not installed or properly patched, though local access would still be required.
🎯 Exploit Status
Requires local access and knowledge of TOCTOU exploitation techniques. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.9 or later
Vendor Advisory: https://support.norton.com/sp/static/external/tools/security-advisories.html
Restart Required: Yes
Instructions:
1. Open Avast/AVG Antivirus. 2. Navigate to Settings > Update. 3. Click 'Update' to download and install the latest version. 4. Restart your computer when prompted.
🔧 Temporary Workarounds
Disable Avast/AVG Antivirus
windowsTemporarily disable the antivirus software to prevent exploitation (not recommended for production environments).
Right-click Avast/AVG tray icon > Avast shields control > Disable for 10 minutes/1 hour/until computer restart
🧯 If You Can't Patch
- Restrict local user access to systems running vulnerable Avast/AVG versions
- Implement application whitelisting to prevent unauthorized process execution
🔍 How to Verify
Check if Vulnerable:
Check Avast/AVG version in the application interface (Menu > About) or via Control Panel > Programs and Features.Check Version:
wmic product where "name like 'Avast%' or name like 'AVG%'" get versionVerify Fix Applied:
Verify the version is 23.9 or higher in the application interface.📡 Detection & Monitoring
Log Indicators:
- Unusual IOCTL requests to Avast/AVG drivers
- Privilege escalation attempts from standard user accounts
Network Indicators:
- None - this is a local exploitation vulnerability
SIEM Query:
EventID=4688 AND ProcessName LIKE '%avast%' AND NewProcessName LIKE '%cmd.exe%' OR NewProcessName LIKE '%powershell.exe%'