Researcher Releases Three Zero-Day Exploits Targeting Avast, CrowdStrike and Nvidia
Summary
Nightmare Eclipse released three proof-of-concept exploits targeting Avast, CrowdStrike and Nvidia products. GenDigital says it fixed the Avast issue; CrowdStrike and Nvidia say they are investigating, with CrowdStrike advising a policy change.
Key points
- Nightmare Eclipse released PrettyPrague, FalconFlank and GreenSection, targeting products from Avast, CrowdStrike and Nvidia.
- PrettyPrague reportedly exploits the Avast sandbox to gain system privileges and may affect other GenDigital products, including AVG and Norton.
- GenDigital said it fixed the reported Avast vulnerability and urged users to keep products updated.
- FalconFlank reportedly exploits CrowdStrike Falcon Sensor's Office malicious-macro remediation feature for privilege escalation.
- CrowdStrike said it is investigating and advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting, while retaining Cloud Anti-malware for Microsoft Office Files settings.
- GreenSection reportedly targets an out-of-bounds memory write in a shared memory section used by Nvidia user-mode components; Nvidia said it is investigating the reported behavior.
- Researcher Kevin Beaumont said the Avast, CrowdStrike and earlier Kaspersky exploits work; the article does not report a fix for the CrowdStrike or Nvidia issues.
Article Details
- Vulnerability Types
- Privilege escalation
- Out-of-bounds memory write
- Improper access controls
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- CrowdStrike advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting; it said customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.
MITRE ATT&CK
People
Chaotic EclipseName the article gives as an alias of security researcher Nightmare Eclipse.Kevin BeaumontSecurity researcher who said the Avast, CrowdStrike, and Kaspersky exploits work.MSNightmareName the article gives as an alias of security researcher Nightmare Eclipse.Nightmare EclipseSecurity researcher who released the PrettyPrague, FalconFlank, and GreenSection exploits; also known as Chaotic Eclipse, Infinite Nightmare, and MSNightmare.
Vendors
AvastThe security researcher known as Nightmare Eclipse has dropped three zero-day exploits targeting products from Avast, CrowdStrike, and Nvidia.CrowdStrikeThe security researcher known as Nightmare Eclipse has dropped three zero-day exploits targeting products from Avast, CrowdStrike, and Nvidia.GenDigitalThe PrettyPrague proof-of-concept (PoC) code, the researcher says, targets the Avast sandbox to spawn a shell with full system privileges, and may also affect other GenDigital products, including AVG and Norton.KasperskyIn late August, Nightmare Eclipse released a privilege escalation zero-day in a Kaspersky endpoint security product.NvidiaThe security researcher known as Nightmare Eclipse has dropped three zero-day exploits targeting products from Avast, CrowdStrike, and Nvidia.
Products
Avast Antiviruswas recently made aware of a security vulnerability affecting a subset of Gen products, including Avast Antivirus, that could allow an attacker to elevate their system privileges. We immediately initiated ourCrowdStrike Falcon SensorFalconFlank exploits a bug in the Office malicious macros remediation feature of CrowdStrike Falcon Sensor for privilege escalation, the researcher says.Kaspersky Endpoint SecurityIn late August, Nightmare Eclipse released a privilege escalation zero-day in a Kaspersky endpoint security product.Nvidia GPU display driver components“We are aware of reports describing a proof-of-concept that demonstrates improper access controls on a shared memory section used by certain NVIDIA GPU display driver components on Windows.
Tools
FalconFlankWithin a short window last week, Nightmare Eclipse dropped three new zero-day exploits, dubbed PrettyPrague, FalconFlank, and GreenSection.GreenSectionWithin a short window last week, Nightmare Eclipse dropped three new zero-day exploits, dubbed PrettyPrague, FalconFlank, and GreenSection.HardBreacherDubbed HardBreacher, the exploit has been patched by Kaspersky on August 31.PrettyPragueWithin a short window last week, Nightmare Eclipse dropped three new zero-day exploits, dubbed PrettyPrague, FalconFlank, and GreenSection.