CVE-2022-28965: 
Avast Premium Security vulnerability analysis and mitigation

Multiple DLL hijacking vulnerabilities were discovered in Avast Premium Security before version 21.11.2500, specifically affecting the components instup.exe and wsc_proxy.exe. The vulnerability was assigned CVE-2022-28965 and was disclosed on May 20, 2022. The issue affects Avast Premium Security installations prior to version 21.11.2500 (NVD, CVE Mitre).

The vulnerability stems from insufficient security checking in two Avast processes: instup.exe and wsc_proxy.exe. These processes attempt to load non-existing DLLs while calling the "REPAIR APP" function. The lack of proper security validation during DLL loading creates a vulnerability that can be exploited by attackers with administrative privileges. The vulnerability has been assigned a CVSS v3 Base Score of 6.5 (Medium), with attack vector being Local, requiring high privileges and user interaction (Github Disclosure).

The exploitation of this vulnerability allows attackers with administrative privileges to execute malicious code within Avast protected processes. This can lead to multiple severe consequences including the ability to deactivate the antivirus regardless of "Self-Defense" protection, terminate Avast antivirus processes, and potentially cause a Denial of Service (DoS) to the affected system (Github Disclosure).

The vulnerability requires local access and administrative privileges to exploit. An attacker would need to drop a malicious DLL in a specific location to be loaded by the affected Avast processes. Since the vulnerable components are Avast protected processes, successful exploitation could lead to control over these protected processes (Github Disclosure).

The vulnerability has been patched in Avast Premium Security version 22.2. Users are advised to upgrade their Avast Premium Security installation to version 22.2 or later to protect against this vulnerability (Github Disclosure).