| タイトル | V-Secure Technology Jingyun Antivirus 2.4.2.39 Exposed IOCTL with Insufficient Access Control |
|---|
| 説明 | Jingyun Antivirus v2.4.2.39 exposes an arbitrary registry key manipulation through IOCTL with insufficient access controls. The driver creates its device object with a security descriptor granting everyone full access. The IOCTL handler 0x226AF0 dispatches to FUN_0001b32c, which performs kernel-mode registry operations (ZwCreateKey, ZwOpenKey, ZwSetValueKey, ZwDeleteKey, etc.) as SYSTEM without any caller authentication. This allows any user — including low-privileged standard users — to read, write, and delete any registry key on the system, bypassing all Windows ACL protections.
The most critical impact of this vulnerability is the ability to disable Windows Defender through the GPO policy registry paths below. Any user can create this key (HKLM\SOFTWARE\Policies\Microsoft\Windows Defender) and set the following values to 1 via the ZyArk.sys registry IOCTL:
- DisableAntiSpyware
- DisableAntiVirus
- Real-Time Protection\DisableRealtimeMonitoring
- Real-Time Protection\DisableBehaviorMonitoring
After restarting, Windows Defender enters "policy disabled" mode—MsMpEng.exe continues to run, but all scanning and protection functions are disabled. The device is completely exposed to malware threats. |
|---|
| ソース | ⚠️ https://github.com/patrickt2017/research/issues/2 |
|---|
| ユーザー | patrickt2017 (UID 97401) |
|---|
| 送信 | 2026年06月20日 20:55 (2 月 ago) |
|---|
| モデレーション | 2026年08月06日 22:09 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 386712 [V-Secure Jingyun Antivirus 2.4.2.39 Kernel Driver ZyArk.sys 特権昇格] |
|---|
| ポイント | 20 |
|---|