Race Condition Vulnerability in AVG Internet Security for Windows XP

CVE-2010-5152

What is CVE-2010-5152?

A race condition in AVG Internet Security 9.0.791 on Windows XP allows local users to execute unauthorized code by manipulating user-space memory during the execution of kernel-mode hook handlers. This exploitation can lead to the bypassing of security measures that would typically protect against unauthorized actions, making the system vulnerable to further attacks. The issue is predicated on certain memory changes that occur amidst the execution of these hook handlers, categorized under the argument-switch or KHOBE attack. It’s worth noting that the nature of this vulnerability has led to some dispute regarding its classification as a security flaw, given that it involves a circumvention of protections for already running processes.

References