CVE-2024-2180: 
Zemana AntiLogger vulnerability analysis and mitigation

Zemana AntiLogger v2.74.204.664 contains a Memory Information Leak vulnerability in the zam64.sys and zamguard64.sys drivers. The vulnerability was discovered on February 23, 2024, and publicly disclosed on March 14, 2024. The issue has been assigned CVE-2024-2180 and affects version 2.74.204.664 of the software (Fluid Advisory).

The vulnerability exists in the 0x80002020 IOCTL code of the zam64.sys and zamguard64.sys drivers, which allows leaking of the kernel base address, effectively bypassing kASLR protection. To exploit this, a call to IOCTL 0x80002010 must first be performed with the current process ID as an authorized IOCTL process caller. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (Fluid Advisory).

The vulnerability allows attackers to leak the kernel base address, which renders the kernel Address Space Layout Randomization (kASLR) protection ineffective. This could potentially be used as part of a larger attack chain to compromise system security (Fluid Advisory).

The vulnerability requires local access and low privileges to exploit. A proof of concept exploit has been confirmed to exist. The attack requires the ability to make IOCTL calls to the affected drivers (Fluid Advisory).

As of the disclosure date, there is no patch available for this vulnerability (Fluid Advisory).