CVE-2024-5102
📋 TL;DR
This vulnerability in Avast Antivirus allows low-privileged Windows users to elevate privileges to SYSTEM level by exploiting a race condition in the repair function. Attackers can delete arbitrary files or execute processes with highest system privileges. It affects Avast Antivirus versions before 24.2 on Windows systems.
💻 Affected Systems
- Avast Antivirus
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where attacker gains SYSTEM privileges, can delete critical system files, install persistent malware, or create backdoors.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, access sensitive data, or disable security software.
If Mitigated
Limited impact if proper user privilege separation exists and repair function is disabled or monitored.
🎯 Exploit Status
Exploitation requires local access, knowledge of symlink/junction creation, and winning a race condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.2 or later
Vendor Advisory: https://support.norton.com/sp/static/external/tools/security-advisories.html
Restart Required: Yes
Instructions:
1. Open Avast Antivirus. 2. Go to Menu → Settings → General → Update. 3. Click 'Check for updates'. 4. Install version 24.2 or later. 5. Restart the computer.
🔧 Temporary Workarounds
Disable Repair Function
windowsRemove access to the repair feature through group policy or permissions
Restrict User Privileges
windowsImplement least privilege principle to limit who can access Avast settings
🧯 If You Can't Patch
- Implement strict user privilege separation - ensure no users have unnecessary local admin rights
- Monitor for suspicious file deletion or symlink creation in AppData directories
🔍 How to Verify
Check if Vulnerable:
Check Avast version: Open Avast → Menu → Settings → General → About. If version is below 24.2, system is vulnerable.Check Version:
wmic product where "name like 'Avast%'" get versionVerify Fix Applied:
Confirm Avast version is 24.2 or higher in About section. Verify repair function no longer creates vulnerable conditions.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in AppData directories
- Multiple repair function invocations by non-admin users
- Symlink or junction creation in user directories
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
EventID=4663 AND ObjectName LIKE '%AppData%' AND AccessMask='0x10000' AND SubjectUserName NOT IN (admin_users)