CVE-2024-7236

Executive Summary

CVE-2024-7236 is a locally exploitable vulnerability in AVG AntiVirus Free that allows an attacker with low-privileged code execution to create a persistent denial-of-service (DoS) condition. The flaw resides in the AVG Installer component, where an unprivileged user can create a symbolic link to abuse the update functionality, causing arbitrary file creation. This can lead to system instability or denial of service. The vulnerability has a CVSS score of 5.3 (Medium) and is currently unpatched. No public exploit code or proof-of-concept is available, but the attack vector is well-understood.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a local privilege escalation and DoS issue in a proprietary Windows antivirus product.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Base Score: 5.3 (Medium)
• Attack Vector: Local (AV:L) – requires physical or remote access to execute low-privileged code.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs only user-level access.
• User Interaction: None (UI:N) – no user action required beyond initial compromise.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – can cause persistent denial of service.

Threat Level: Medium. Exploitation requires local access, but the impact on availability is significant. The lack of a patch increases risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is a classic symlink following issue (CWE-59: Improper Link Resolution Before File Access). The AVG Installer component, during its update process, creates or writes to files in a directory that is writable by low-privileged users. An attacker can pre-create a symbolic link in that directory pointing to a critical system file (e.g., C:\Windows\System32\drivers\etc\hosts or a boot configuration file). When the AVG update runs with elevated privileges, it follows the symlink and writes to the target file, corrupting it and causing a denial of service.

Attack Flow:

1. Attacker gains low-privileged code execution on the target system.
2. Attacker identifies a directory used by AVG Installer during updates (e.g., C:\ProgramData\AVG\Update\).
3. Attacker creates a symbolic link in that directory pointing to a critical system file.
4. AVG update process runs (triggered by schedule or manually) and writes to the symlink target.
5. The critical system file is corrupted, leading to system instability or crash.

Root Cause: The AVG Installer does not validate that the target path is not a symbolic link before writing. It also does not drop privileges or use secure file operations.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resembles:

// Vulnerable pseudo-code
void update_installer() {
    char path[] = "C:\\ProgramData\\AVG\\Update\\temp_file";
    FILE *f = fopen(path, "w");
    if (f) {
        fwrite(update_data, 1, size, f);
        fclose(f);
    }
}

A patched version would need to:

• Use CreateFile with FILE_FLAG_OPEN_REPARSE_POINT to avoid following symlinks.
• Verify the final path is within an expected directory using GetFinalPathNameByHandle.
• Run the update process with reduced privileges or use a secure temporary directory.

// Patched pseudo-code
void update_installer() {
    HANDLE hFile = CreateFile(
        path,
        GENERIC_WRITE,
        0,
        NULL,
        CREATE_ALWAYS,
        FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OPEN_REPARSE_POINT,
        NULL
    );
    if (hFile != INVALID_HANDLE_VALUE) {
        // Write data
        WriteFile(hFile, update_data, size, &bytesWritten, NULL);
        CloseHandle(hFile);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows system with AVG AntiVirus Free installed.
• Low-privileged user account or code execution capability.

Exploitation Steps:

1. Identify the writable directory used by AVG Installer (e.g., C:\ProgramData\AVG\Update\).
2. Create a symbolic link:

   mklink "C:\ProgramData\AVG\Update\target.dll" "C:\Windows\System32\drivers\etc\hosts"
   

3. Trigger the AVG update (e.g., by running avgupdate.exe or waiting for automatic update).
4. The update process writes to the symlink, corrupting the hosts file and causing network-related DoS.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for creation of symbolic links in C:\ProgramData\AVG\Update\ or similar directories.
• Alert on unexpected file writes to critical system paths (e.g., hosts, boot configuration).
• Use Sysmon Event ID 7 (Image loaded) and Event ID 11 (FileCreate) to track file operations.

Hunting:

• Search for symlinks in C:\ProgramData\AVG\Update\ using PowerShell:

  Get-ChildItem -Path "C:\ProgramData\AVG\Update\" -Recurse | Where-Object { $_.LinkType -eq "SymbolicLink" }
  

• Check for recent modifications to C:\Windows\System32\drivers\etc\hosts or other critical files.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_7236_AVG_Symlink_DoS {
    meta:
        description = "Detects symbolic link creation in AVG update directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7236"
    strings:
        $s1 = "C:\\ProgramData\\AVG\\Update" nocase
        $s2 = "SymbolicLink" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: AVG AntiVirus Free Symlink DoS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of symbolic links in AVG update directory
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7236
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11  # FileCreate
        TargetFilename|contains: 'C:\ProgramData\AVG\Update\'
        TargetFilename|endswith: '.lnk'
    condition: selection
falsepositives:
    - Legitimate AVG update operations (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7236 AVG Symlink DoS - Potential Update Abuse"; flow:to_server; content:"avgupdate"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict permissions on C:\ProgramData\AVG\Update\ to prevent low-privileged users from creating files or symlinks.
2. Disable automatic updates for AVG until a patch is available.
3. Monitor for symlink creation in sensitive directories using Sysmon or EDR.

Long-term Fix:

• Vendor must release a patch that validates file paths and uses secure file operations (e.g., FILE_FLAG_OPEN_REPARSE_POINT).
• Consider migrating to a different antivirus solution if no patch is forthcoming.

Workarounds:

• Use Windows Defender or other security software that is actively maintained.
• Implement application whitelisting to block unauthorized symlink creation.

Valters IT