CVE-2024-7235

Executive Summary

CVE-2024-7235 is a local denial-of-service (DoS) vulnerability in AVG AntiVirus Free, specifically within the AVG Service component. The flaw allows an attacker with low-privileged code execution on the target system to create a symbolic link, which the AVG Service then follows to create a folder in an unintended location. This can lead to a denial-of-service condition by corrupting system files or exhausting disk space. The vulnerability has a CVSS score of 6.1 (Medium) and is currently unpatched. No public proof-of-concept (PoC) or exploit code is available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Local (AV:L) – requires physical or remote access to the system.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs low-privileged code execution.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – can cause system instability or crash.

Threat Level: Medium. The vulnerability requires local access and low privileges, limiting remote exploitation. However, if an attacker already has a foothold, it can be used to disrupt operations.

Deep Dive & Mechanics

The vulnerability resides in the AVG Service, which runs with elevated privileges. The service performs file system operations (creating folders) without properly validating symbolic links. An attacker with low-privileged code execution can create a symbolic link pointing to a critical system path (e.g., C:\Windows\System32). When the AVG Service follows the link and creates a folder, it can overwrite or corrupt system files, leading to a denial-of-service condition.

Attack Flow:

1. Attacker gains low-privileged code execution on the target (e.g., via malware or user compromise).
2. Attacker creates a symbolic link from a location the AVG Service monitors to a critical system directory.
3. AVG Service attempts to create a folder in the monitored location, following the symbolic link.
4. The folder creation in the critical directory causes system instability or crash.

Root Cause: Improper handling of symbolic links (CWE-59: Improper Link Resolution Before File Access). The service does not check if the target path is a symbolic link or if the destination is a protected system location.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is in the AVG Service binary (likely avgservice.exe or similar). The service likely uses CreateDirectory or CreateFile API without first checking for symbolic links using GetFileInformationByHandleEx or NtQueryInformationFile.

Vulnerable Code (Conceptual):

// Vulnerable: No symlink check
CreateDirectory(L"C:\\ProgramData\\AVG\\Temp", NULL);

Patched Code (Hypothetical):

// Patched: Check for symlink before creating directory
HANDLE hFile = CreateFile(L"C:\\ProgramData\\AVG\\Temp", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
if (hFile != INVALID_HANDLE_VALUE) {
    BY_HANDLE_FILE_INFORMATION info;
    GetFileInformationByHandle(hFile, &info);
    if (info.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) {
        // Handle symlink safely
    }
    CloseHandle(hFile);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows system with AVG AntiVirus Free installed.
• Low-privileged user account or code execution.

Steps:

1. Identify a directory the AVG Service writes to (e.g., C:\ProgramData\AVG\Temp).
2. Create a symbolic link:

   mklink /D C:\ProgramData\AVG\Temp\evil C:\Windows\System32
   

3. Trigger the AVG Service to create a folder in the monitored location (e.g., by performing a scan or update).
4. The service follows the symlink and creates a folder in C:\Windows\System32, causing system instability.

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team

Detection:

• Monitor for symbolic link creation events (Event ID 4663 with access mask 0x1).
• Monitor for unexpected folder creation in protected system directories.
• Use Sysmon to log file creation events (Event ID 11) and look for C:\Windows\System32 or other critical paths.

Mitigation:

• Restrict low-privileged users from creating symbolic links (via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Create symbolic links).
• Use Windows Defender Application Control (WDAC) to block untrusted binaries.
• Apply the principle of least privilege to the AVG Service.

Indicators of Compromise (IOCs)

• File System:
  • Symbolic link at C:\ProgramData\AVG\Temp\* pointing to C:\Windows\System32 or other critical paths.
  • Unexpected folders in C:\Windows\System32 (e.g., C:\Windows\System32\AVG).
• Process:
  • avgservice.exe creating folders in protected directories.
• Event Logs:
  • Windows Security Event ID 4663 (attempt to create a symbolic link).
  • Sysmon Event ID 11 (FileCreate) with TargetFilename containing C:\Windows\System32.

Detection Engineering

YARA Rule

rule CVE_2024_7235_AVG_Symlink_DoS {
    meta:
        description = "Detects symbolic link creation targeting AVG AntiVirus Free"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7235"
    strings:
        $symlink_cmd = "mklink" nocase
        $avg_path = "C:\\ProgramData\\AVG" nocase
        $system32 = "C:\\Windows\\System32" nocase
    condition:
        $symlink_cmd and $avg_path and $system32
}

Sigma Rule

title: CVE-2024-7235 AVG AntiVirus Free Symlink DoS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects symbolic link creation to critical system paths by low-privileged users
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7235
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectType: 'File'
        AccessMask: '0x1'  # Create symbolic link
        ObjectName|contains: 'C:\ProgramData\AVG'
    condition: selection
falsepositives:
    - Legitimate AVG updates
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7235 AVG AntiVirus Free Symlink DoS"; flow:to_server; content:"mklink"; nocase; content:"C:\\ProgramData\\AVG"; nocase; content:"C:\\Windows\\System32"; nocase; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

• Restrict low-privileged users from creating symbolic links via Group Policy.
• Monitor for suspicious file system activity in C:\ProgramData\AVG.
• Apply Windows Defender Application Control (WDAC) to block untrusted binaries.

Long-Term:

• Await an official patch from AVG (Gen Digital).
• Consider switching to an alternative antivirus solution if the risk is unacceptable.
• Implement application whitelisting to prevent unauthorized code execution.

Workaround:

• Remove write permissions for low-privileged users on C:\ProgramData\AVG (may break AVG functionality).

Valters IT