CVE-2023-5760: Time-of-check to time-of-use (TOCTOU) bug leads to full local privilege escalation.

Published Nov 8, 2023

Updated

A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability which can be further exploited, allowing an attacker to gain full local privilege escalation on the system.This issue affects Avast/Avg Antivirus: 23.8.

Affected Software

1 affected component

Avast Avg Antivirus=23.8

Remediation

Information

We encourage customers to ensure their security software is always updated to the latest version available.

Event History

Nov 8, 2023

CVE Published

via MITRE·04:36 PM

Data Sourced

via MITRE·04:36 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2023-5760?

CVE-2023-5760 is a time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL requests, which can lead to a full local privilege escalation.

How does CVE-2023-5760 affect Avast/Avg AntiVirus?

CVE-2023-5760 affects Avast/Avg AntiVirus version 23.8, allowing an attacker to gain full local privilege escalation on the system.

What is the severity of CVE-2023-5760?

The severity of CVE-2023-5760 is high with a CVSS score of 8.2.

How can an attacker exploit CVE-2023-5760?

An attacker can exploit CVE-2023-5760 by exploiting the TOCTOU bug, which leads to an out-of-bounds write vulnerability, allowing them to gain full local privilege escalation.

How can I fix CVE-2023-5760?

To fix CVE-2023-5760, it is recommended to update Avast/Avg AntiVirus to the latest version.