SECURITY Signal 508
CVE-2025-13032: Exploiting Avast Antivirus Kernel Driver Double-Fetch Vulnerability
↗
The post details how a double-fetch bug in Avast's kernel driver was turned into an arbitrary kernel read/write primitive and used to gain SYSTEM privileges on Windows 11.
The exploit demonstrates a practical path to local privilege escalation that bypasses recent Windows kernel mitigations, highlighting the risk of relying on user-mode accessors for driver security.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
A double-fetch in the I/O control handler leads to a paged pool overflow when the Length field is toggled concurrently.
The overflow enables arbitrary kernel read/write, allowing the attacker to corrupt kernel structures and steal a SYSTEM token.
The technique works on up-to-date Windows 11 systems before the mitigation that uses user-mode accessors is applied.
THE READ
What the cluster adds up to.
The vulnerability stems from a double fetch of the Length field in a _UNICODE_STRING structure passed to a vulnerable IOCTL, causing a pool overflow when the value changes between allocation and copy operations.
By racing the Length field across threads, an attacker can allocate a small buffer but copy a much larger payload, corrupting adjacent heap objects and gaining arbitrary kernel read/write capabilities.
The exploit chain culminates in token theft to achieve SYSTEM privileges, but the authors note that a recent mitigation using user-mode accessors can block this specific technique, underscoring the importance of up-to-date defenses.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER