CVE-2024-7234

Executive Summary

CVE-2024-7234 is a local privilege escalation vulnerability in AVG AntiVirus Free, specifically within the AVG Service (AVGSvc). The flaw allows an attacker with low-privileged code execution on the target system to abuse a symbolic link operation to delete arbitrary files as SYSTEM. By chaining this with other techniques (e.g., DLL hijacking or file replacement), an attacker can achieve full SYSTEM-level code execution. The vulnerability has a CVSS score of 7.8 (High) and is currently unpatched. No public exploit code or proof-of-concept is available, but the attack vector is well-understood and poses a significant risk in enterprise environments where AVG is deployed.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a native Windows application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker must have initial low-privileged code execution.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – the vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – full SYSTEM access allows reading all files.
• Integrity Impact: High (I:H) – arbitrary file deletion and potential code execution.
• Availability Impact: High (A:H) – can delete critical system files.

Threat Level: High. The vulnerability is easy to exploit once low-privileged access is obtained, and it leads to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the AVG Service (AVGSvc.exe), which runs with SYSTEM privileges. The service performs file operations without proper validation of symbolic links. Specifically, when the service attempts to delete a file, it follows a symbolic link that an attacker can create in a location writable by low-privileged users.

Attack Flow:

1. Attacker gains low-privileged code execution on the target (e.g., via phishing, malicious document, or another vulnerability).
2. Attacker identifies a file path that the AVG Service will delete (e.g., a temporary file or quarantine artifact).
3. Attacker creates a symbolic link pointing from that path to a critical system file (e.g., C:\Windows\System32\config\SAM or a driver file).
4. When the AVG Service performs the delete operation, it follows the symbolic link and deletes the target file as SYSTEM.
5. Attacker can then exploit the deleted file (e.g., replace it with a malicious version) to escalate privileges or cause denial of service.

The core issue is a classic Untrusted Search Path or Symbolic Link Following vulnerability (CWE-59). The service does not verify that the file being deleted is not a symbolic link, nor does it run in a secure directory context.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior:

Vulnerable Code (Conceptual):

// AVGSvc.exe - vulnerable file deletion routine
void DeleteFileIfExists(const std::wstring& path) {
    if (PathFileExists(path.c_str())) {
        DeleteFile(path.c_str());  // Follows symbolic links
    }
}

Patched Code (Hypothetical):

// Patched version - uses secure file operations
void DeleteFileIfExists(const std::wstring& path) {
    HANDLE hFile = CreateFile(
        path.c_str(),
        DELETE,
        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
        NULL,
        OPEN_EXISTING,
        FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_DELETE_ON_CLOSE,
        NULL
    );
    if (hFile != INVALID_HANDLE_VALUE) {
        CloseHandle(hFile);
    }
}

The patched version uses FILE_FLAG_OPEN_REPARSE_POINT to prevent following symbolic links and FILE_FLAG_DELETE_ON_CLOSE to delete the file securely.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Low-privileged shell on a Windows system with AVG AntiVirus Free installed.
• Knowledge of a file path that AVGSvc will delete (e.g., C:\ProgramData\AVG\...\temp\*.tmp).

Exploitation Steps:

1. Identify the target file path that AVGSvc deletes (e.g., via Procmon).
2. Create a symbolic link:

   mklink C:\ProgramData\AVG\...\temp\delete_me.tmp C:\Windows\System32\config\SAM
   

3. Trigger the AVG service to delete the file (e.g., by initiating a scan or update).
4. After deletion, the system may crash or become unstable. For privilege escalation, replace the deleted file with a malicious version (e.g., a malicious DLL that gets loaded by a SYSTEM process).

Example PowerShell Script (Conceptual):

# Requires SeCreateSymbolicLinkPrivilege (usually not available to low-priv users)
# Alternative: Use junction points or mount points
New-Item -ItemType SymbolicLink -Path "C:\ProgramData\AVG\temp\delete_me.tmp" -Target "C:\Windows\System32\drivers\etc\hosts"

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor for symbolic link creation events (Event ID 4663 with access mask 0x1).
• Monitor for file deletion events by AVGSvc.exe (Event ID 4658).
• Use Sysmon to log process creation and file creation events.

Defense:

• Apply the principle of least privilege to the AVG service.
• Use Windows Defender Application Control (WDAC) to block untrusted symbolic link creation.
• Enable Windows 10/11 "Controlled Folder Access" to protect critical system files.
• Monitor for unusual file deletions by AVGSvc.exe.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_7234_AVG_Symlink_Abuse {
    meta:
        description = "Detects symbolic link creation targeting AVG service temp paths"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7234"
    strings:
        $s1 = "AVGSvc" nocase
        $s2 = "\\ProgramData\\AVG\\" nocase
        $s3 = "SymbolicLink" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-7234 - AVG AntiVirus Free Local Privilege Escalation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects symbolic link creation in AVG service directories
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7234
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|contains: '\\ProgramData\\AVG\\'
        TargetFilename|endswith: '.tmp'
    condition: selection
falsepositives:
    - Legitimate AVG operations (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7234 - AVG Symlink Abuse"; flow:to_server,established; content:"AVGSvc"; nocase; content:"SymbolicLink"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the AVG Service if not critical: sc stop AVGSvc and sc config AVGSvc start= disabled.
2. Apply Windows Defender as a temporary replacement.
3. Monitor for exploitation using the provided detection rules.

Long-term Fix:

• Await an official patch from AVG (Gen Digital). Contact vendor support for updates.
• If AVG is not essential, consider migrating to a different antivirus solution.

Compensating Controls:

• Enable Windows Defender Exploit Guard (Network Protection, Controlled Folder Access).
• Restrict symbolic link creation to administrators via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Create symbolic links.
• Use AppLocker or WDAC to block untrusted binaries.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2024-7234