Week of June 12, 2023

Researcher VoidSec disclosed two vulnerabilities in the Zemana AntiMalware and AntiLogger drivers (zamguard64.sys/zam64.sys). CVE-2023-36205 allows a non-privileged user to open a handle to any privileged process via IOCTL 0x8000204C, enabling code injection and privilege escalation to SYSTEM. CVE-2023-36204 grants unrestricted disk read/write through IOCTLs 0x80002014 and 0x80002018, allowing sensitive file disclosure or system compromise.

CVE-2023-2270 is a privilege escalation vulnerability in the Netskope client on Windows. The flaw allows a local attacker to write arbitrary files via path traversal, leading to code execution with NT\SYSTEM privileges. It affects Netskope Client versions prior to R100.

A path traversal vulnerability in VIPRE Antivirus Plus allows local attackers to escalate privileges to SYSTEM. The flaw exists in the SetPrivateConfig method due to improper validation of user-supplied paths. VIPRE has released an update to address the issue.

ScareCrow is a payload creation framework that sideloads a DLL into a legitimate Windows process and removes EDR userland hooks from system DLLs in memory. It uses two unhooking methods (disk-based and KnownDLLs) and employs indirect syscalls to evade detection. The framework also generates fake code-signing certificates to blend in.

CVE-2023-20867 is an authentication bypass vulnerability in VMware Tools that allows a compromised ESXi host to force authentication failures in host-to-guest operations. This flaw impacts confidentiality and integrity of guest VMs, enabling attackers with hypervisor control to access guest systems without proper authentication. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation.