CVE-2021-31728 Overview
CVE-2021-31728 is a local privilege escalation vulnerability in MalwareFox AntiMalware 2.74.0.150. The flaw resides in the zam64.sys and zam32.sys kernel drivers, which expose insufficiently restricted I/O Control (IOCTL) handlers. A non-privileged process can open a handle to \\.\ZemanaAntiMalware, register with the driver, allocate executable kernel memory, install a hook, and execute attacker-controlled code in ring 0. Successful exploitation grants SYSTEM-level privileges on the affected host.
Critical Impact
Local attackers can achieve ring 0 code execution in the context of the MalwareFox driver, escalating from a low-privileged user to full kernel privileges on Windows endpoints.
Affected Products
- MalwareFox AntiMalware 2.74.0.150
- zam64.sys kernel driver bundled with the affected version
- zam32.sys kernel driver bundled with the affected version
Discovery Timeline
- 2021-05-17 - CVE-2021-31728 published to the National Vulnerability Database
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2021-31728
Vulnerability Analysis
The vulnerability is a driver-level broken access control issue [NVD-CWE-Other] in MalwareFox's anti-malware kernel components. The zam64.sys and zam32.sys drivers create a device object accessible as \\.\ZemanaAntiMalware and expose multiple IOCTL handlers without enforcing caller integrity or privilege checks.
A non-privileged process can chain four IOCTLs to achieve kernel code execution. First, the process opens a handle to the device. It then issues IOCTL 0x80002010 to register itself as a trusted client of the driver. With this trust established, IOCTL 0x80002040 allocates writable and executable memory in kernel context, providing a controllable payload region.
Next, IOCTL 0x80002044 installs a hook that redirects driver control flow into the attacker-allocated buffer. Triggering IOCTL 0x80002014 or 0x80002018 invokes the hook and transfers execution to the buffer at ring 0. Because the driver runs at the highest privilege level, the payload executes with full kernel rights.
Root Cause
The drivers fail to validate the privilege level of calling processes and treat self-registration via IOCTL 0x80002010 as sufficient authorization. They also expose primitives for allocating executable kernel memory and installing arbitrary hooks, which should never be reachable from user mode.
Attack Vector
Exploitation requires local code execution as any logged-on user. No administrative rights, no user interaction beyond running the exploit, and no network exposure are needed. See the GitHub PoC Repository for the technical analysis and proof-of-concept walkthrough.
Detection Methods for CVE-2021-31728
Indicators of Compromise
- Unexpected user-mode processes opening handles to \\.\ZemanaAntiMalware outside of the MalwareFox product binaries.
- DeviceIoControl calls targeting IOCTL codes 0x80002010, 0x80002040, 0x80002044, 0x80002014, or 0x80002018 from non-MalwareFox processes.
- Presence of zam64.sys or zam32.sys at version 2.74.0.150 on production endpoints.
Detection Strategies
- Monitor kernel object access events for handles to the MalwareFox device name issued by unsigned or unexpected processes.
- Hunt for processes that suddenly elevate from a medium integrity level to SYSTEM without an associated UAC or service launch event.
- Correlate driver load telemetry with the vulnerable driver hashes and flag hosts still running the affected versions.
Monitoring Recommendations
- Enable Windows kernel auditing for driver IOCTL activity on hosts that host third-party security drivers.
- Track process creation chains where a low-privileged parent spawns a SYSTEM-level child shortly after interacting with \\.\ZemanaAntiMalware.
- Alert on installation or persistence of legacy MalwareFox 2.74.0.150 binaries via software inventory tooling.
How to Mitigate CVE-2021-31728
Immediate Actions Required
- Identify all endpoints running MalwareFox AntiMalware 2.74.0.150 and prioritize them for remediation.
- Upgrade affected installations to a vendor-provided release that ships patched zam64.sys and zam32.sys drivers.
- Restrict local logon and code execution rights on systems where the vulnerable driver cannot be immediately replaced.
Patch Information
No vendor advisory URL is published in the NVD record for CVE-2021-31728. Administrators should obtain the latest MalwareFox AntiMalware build directly from the vendor and verify that the bundled zam64.sys and zam32.sys drivers are newer than version 2.74.0.150 before redeploying.
Workarounds
- Uninstall MalwareFox AntiMalware 2.74.0.150 on systems where an updated build is not yet available.
- Use Windows Defender Application Control or a Windows Driver Block List policy to prevent the vulnerable driver versions from loading.
- Limit interactive and remote logon rights so that only trusted administrators can execute code locally on affected hosts.
# Example: block the vulnerable driver from loading via sc.exe (run as Administrator)
sc.exe config zam64 start= disabled
sc.exe config zam32 start= disabled
sc.exe stop zam64
sc.exe stop zam32
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
