OPSWAT AppRemover Driver Improper Access Control Vulnerability Allowing Process Termination

A vulnerability exists in the OPSWAT AppRemover Driver (ardrv.sys) in versions through 2017.10.02.1551. The issue arises in the IOCTL handler 0x2420031, where the driver allows any local user to terminate processes without proper privilege validation. This flaw can be exploited to disrupt security software or critical system processes, leading to a denial-of-service condition and potential anti-forensic advantages.

Impact

Exploitation of this vulnerability allows unauthorized process termination, which can disable security software, cause system crashes, and disrupt logging or monitoring tools.

Remediation

Users should treat the AppRemover Driver (ardrv.sys) version 2017.10.02.1551 and earlier as vulnerable. If the AppRemover functionality is not needed, the driver should be removed or prevented from loading. For systems that require OPSWAT AppRemover, consider applying the latest updates or patches provided by OPSWAT.