Hackers Achieve Kernel Privilege Escalation via Avast Antivirus Flaw

Overview

Researchers from the Safateam have successfully demonstrated a full kernel privilege escalation attack against Avast Antivirus on an up-to-date Windows 11 system. The exploitation leverages CVE-2025-13032, a double-fetch vulnerability discovered within the antivirus software’s kernel driver. This flaw allows attackers to bypass security boundaries and elevate their privileges to the SYSTEM level, effectively granting unrestricted control over the operating system.

This report details the second phase of the research, which builds upon the initial discovery of the vulnerability. By turning a controlled paged pool overflow into an arbitrary kernel read/write primitive, the team was able to compromise the integrity of the I/O Ring object. The attack chain involves sophisticated heap spraying, kernel address leakage via Memory Descriptor List introspection, and careful teardown to avoid system crashes.

Vulnerability Mechanism

The core of the issue is a double-fetch vulnerability in how the Avast driver handles user-supplied _UNICODE_STRING structures. When processing specific I/O control codes, the driver fetches the Length field from user mode multiple times without sufficient validation.

The process begins with the driver verifying that the user buffer is accessible using ProbeForRead. It then calls an internal function to allocate a buffer based on the current length value. However, the actual data copy operation retrieves the length a second time. If an attacker modifies the length field between these two fetches, the driver allocates a small buffer but copies a significantly larger amount of data into it.

// Simplified representation of the double-fetch flaw
PoolWithTag = ExAllocatePoolWithTag(PagedPool, length_small, tag);
// ... context switch or race condition ...
memmove(PoolWithTag + 1, Buffer, length_large); // Overflow occurs here

To exploit this race condition, the researchers employed a multi-threaded approach. One thread continuously toggles the Length field of a shared structure between a safe, small value and a malicious, large value. Simultaneously, another thread repeatedly triggers the vulnerable IOCTL. By carefully timing these operations, the attackers can reliably win the race window, causing a buffer overflow in the Paged Pool.

Exploitation Chain

With the pool overflow established, the next challenge was converting it into a functional arbitrary kernel read/write primitive. The Paged Pool, used by Windows for non-critical kernel objects, groups allocations by size class, making it susceptible to heap spraying techniques. The researchers targeted the I/O Ring Object, a kernel structure that manages asynchronous I/O submission queues.

By corrupting the RegBuffers array within the I/O Ring object, the attackers gained the ability to read from and write to arbitrary kernel addresses. This stage required a precise heap spray strategy to ensure the overflow landed in the desired target location. The researchers also had to account for the differences in allocation backends introduced in Windows 10 19H1, specifically the Low Fragmentation Heap (LFH) and the Virtual Size (VS) allocator.

The paged pool is a region of Windows kernel memory used for objects and data that the kernel or drivers need, but that can be paged out to disk. It is used for memory that does not need to be accessed by critical code running with high priority.

Once the read/write primitive was secured, the team performed a kernel address leak by introspecting Memory Descriptor Lists (MDLs). This step was crucial for bypassing Kernel Address Space Layout Randomization (KASLR), a key mitigation technique that randomizes kernel memory locations to prevent exploitation.

Privilege Escalation and Teardown

The final stage of the attack involved escalating privileges from the current user context to the SYSTEM account, the highest privilege level in Windows. This was achieved through token theft, where the attacker located the security token of a privileged process and duplicated it for their own malicious process.

Avoiding a blue screen of death (BSOD) during the teardown phase was a critical consideration. Corrupting kernel objects like the I/O Ring requires careful restoration of overwritten data to maintain system stability after the exploit has served its purpose. The researchers implemented repair mechanisms to reverse the corruption, ensuring the system remained in a consistent state while the attacker retained elevated privileges.

It is important to note that recent updates to Windows kernel drivers now enforce the use of user-mode accessors to verify each kernel access to user-mode memory. This mitigation ensures that user buffers reside in userspace at the time of every access, effectively preventing the double-fetch technique described in this writeup. Consequently, this specific exploitation path is no longer viable on the latest versions of Windows, though it highlights the severity of the vulnerability in affected systems.

Security Implications

The successful exploitation of CVE-2025-13032 demonstrates the dangers of complex kernel drivers bundled with consumer security software. Even widely trusted antivirus solutions can introduce significant attack surfaces if input validation is lax. The ability to escalate to SYSTEM allows attackers to install rootkits, disable security features, and exfiltrate sensitive data with impunity.

Organizations and individuals running affected versions of Avast Antivirus should prioritize applying any available patches. For those unable to update immediately, monitoring system integrity and reviewing driver access logs can help detect signs of compromise. This research underscores the ongoing arms race between threat actors seeking kernel-level access and defenders working to harden the most critical components of the operating system.