CVE-2017-8339 in Free Antivirus
Summary
by MITRE
PSKMAD.sys in Panda Free Antivirus 18.0 allows local users to cause a denial of service (BSoD) via a crafted DeviceIoControl request to \\.\PSMEMDriver.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2020
The vulnerability identified as CVE-2017-8339 resides within the PSKMAD.sys kernel driver component of Panda Free Antivirus version 18.0, representing a critical local privilege escalation and system stability issue. This driver interface exposes a security flaw that can be exploited through improper input validation during DeviceIoControl operations, specifically targeting the named pipe \.\PSMEMDriver. The vulnerability manifests as a denial of service condition resulting in a Blue Screen of Death (BSoD) when malicious input is processed by the kernel-mode driver. The flaw stems from inadequate parameter validation within the driver's ioctl handling mechanism, allowing crafted requests to trigger memory corruption or invalid memory access patterns that crash the operating system kernel.
The technical implementation of this vulnerability operates through a classic buffer overflow or improper input validation attack vector where local users can construct malicious DeviceIoControl requests with malformed parameters. When the PSKMAD.sys driver processes these crafted requests, it fails to properly validate the input data structures, leading to memory corruption that ultimately results in system instability and kernel crashes. This type of vulnerability falls under the CWE-121 category of Stack-based Buffer Overflow, though the specific manifestation in this kernel driver context creates a more severe impact due to the privileged execution context. The ATT&CK framework categorizes this as a privilege escalation technique through kernel-mode exploitation, where local adversaries can leverage the driver's insecure handling of user-supplied data to gain system-level control over the target machine.
The operational impact of CVE-2017-8339 extends beyond simple denial of service to potentially enable more sophisticated attacks when combined with other exploitation techniques. System administrators and security professionals must recognize that this vulnerability provides attackers with a reliable method to crash target systems, which could be used for disruptive attacks or as a stepping stone for more complex exploitation chains. The local nature of the vulnerability means that any user with access to the system can potentially trigger the exploit, making it particularly dangerous in multi-user environments or when system privileges are compromised through other means. Organizations running Panda Free Antivirus 18.0 should consider this vulnerability as a high-priority concern for system stability and availability, particularly in environments where continuous system uptime is critical.
Mitigation strategies for this vulnerability should prioritize immediate patching of the Panda Free Antivirus software to the latest version that addresses the kernel driver security flaws. System administrators should also implement additional monitoring and logging around kernel-mode driver activity to detect potential exploitation attempts. The recommended approach includes disabling unnecessary kernel drivers when possible and implementing strict access controls on system resources. Security teams should consider deploying endpoint protection solutions that can detect and prevent malicious DeviceIoControl requests targeting known vulnerable drivers. Additionally, regular security assessments should include verification of driver integrity and monitoring for unauthorized driver modifications that could indicate exploitation attempts. The vulnerability highlights the importance of proper kernel-mode input validation and the necessity of comprehensive security testing for all system-level components.