A local privilege escalation vulnerability in OpenEDR allows an attacker to bypass self-defense mechanisms and gain unauthorized access to privileged kernel driver functionality.

This vulnerability involves a flaw in the self-defense mechanism of the OpenEDR kernel driver, which fails to properly validate process identity. A local attacker with low privileges can bypass these protections by renaming a malicious file to match a trusted process name, subsequently interacting with restricted IOCTLs.

The exploitation of this vulnerability compromises the integrity of the endpoint security agent, effectively rendering the EDR solution blind or controllable by the attacker. With a CVSS score of 7.8, this flaw presents a high risk to organizational security, as it facilitates further local privilege escalation and the potential for full system compromise.

Immediate Action: Monitor official vendor channels for the release of a security patch addressing this bypass, and restrict local user execution permissions to prevent the deployment of unauthorized binaries.

Proactive Monitoring: Review system logs for unexpected process renames or unauthorized attempts to communicate with the OpenEDR kernel driver via IOCTLs.

Compensating Controls: Implement strict Application Control or Endpoint Hardening policies that prevent non-administrative users from executing binaries from temporary directories or renaming critical system files.

Public Exploit Available: Yes (A technical write-up detailing the bypass methodology is available via the researcher's blog at Scavenger Security).

Given the ability of this vulnerability to bypass primary security controls, organizations should prioritize the mitigation of local attack vectors. Security teams must monitor Comodo security advisories and apply the forthcoming patch immediately upon release to restore the integrity of the OpenEDR self-defense model.