A vulnerability in the OPSWAT AppRemover kernel driver (ardrv.sys) allows local users to terminate arbitrary processes, posing a significant risk of security software tampering and denial of service.

This is a privilege validation failure within the IOCTL handler 0x2420031 of the kernel driver. Any local user, regardless of their privilege level, can open the device and send requests to terminate processes, effectively bypassing standard access controls.

The ability for a local attacker to terminate arbitrary processes, including endpoint protection or security agents, creates a critical security gap. Successful exploitation leads to a denial of service, potential disabling of defensive tooling, and the facilitation of anti-forensic activities. With a CVSS score of 7.8, this high-severity flaw requires immediate attention to prevent unauthorized disruption of critical security infrastructure.

Immediate Action: Identify and inventory systems running the affected version of the OPSWAT AppRemover driver. Restrict access to the driver device object if possible while awaiting an official vendor patch.

Proactive Monitoring: Monitor system logs for unexpected process terminations or events indicating that security services have been forcibly stopped.

Compensating Controls: Use Endpoint Detection and Response (EDR) solutions to monitor for unauthorized attempts to interact with kernel drivers or attempts to terminate protected system processes.

Public Exploit Available: Yes: a public proof-of-concept exists on GitHub.

The risk posed by this driver vulnerability is significant due to the potential for security bypass. Administrators should prioritize the identification of all instances of the affected driver and apply vendor updates as soon as they become available. Until patches are applied, consider isolating affected systems or implementing strict local access controls to limit the attack surface.