CVE-2024-5102: 
Avast Antivirus vulnerability analysis and mitigation

A high-severity vulnerability (CVE-2024-5102) was discovered in Avast Antivirus versions prior to 24.2 on Windows systems. The vulnerability exists within the "Repair" feature (accessed via settings -> troubleshooting -> repair) and was discovered by security researcher Naor Hodorov (Norton Advisory, NVD).

The vulnerability stems from how the repair function handles symbolic links (symlinks) when attempting to delete a file in the current user's AppData directory as NT AUTHORITY\SYSTEM. The issue involves a race condition where a low-privileged user can create a pseudo-symlink and a junction folder pointing to a file on the system. The CVSS v4.0 score is 7.3 (HIGH) with the vector string CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (Norton Advisory).

Successful exploitation of this vulnerability allows an attacker to delete arbitrary files or execute processes with NT AUTHORITY\SYSTEM privileges. This could enable attackers to delete critical system files, install malware, or gain complete control over the affected system (Security Online).

The vulnerability requires local access and involves winning a race condition to re-create system files and make Windows callback to a specially-crafted file. While this adds complexity to the exploitation, successful attacks could result in launching a privileged shell instance (NVD).

Avast has addressed this vulnerability in version 24.2 of their antivirus software. Users are strongly encouraged to update their software immediately to the latest version to protect against potential attacks (Security Online).