Race condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack
Published Aug 25, 2012
4.8
MEDIUMCVSS 3.1
EPSS 0.31%
Description
Race condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute
Affected products
No data.
- 7.0.20.37
Running on/with
- n/a
-
- Version 7.0.20.37StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Pwicorp | Privatefirewall | n/a |
|
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
No CVSS v3.0 score for this CVE.
AV:L/AC:H/Au:N/C:C/I:C/A:C
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Jun 26, 2024 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (8 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.31% (0.00306) | 21.17th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.31% (0.00306) | 22.04th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.05% (0.00047) | 11.74th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.04% (0.00042) | 5.07th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.04% (0.00042) | 5.63th | v3 (v2023.03.01) |
| Mar 6, 2023 | 2.17% (0.02172) | 80.27th | v2 (v2022.01.01) |
| Apr 1, 2022 | 2.17% (0.02172) | 78.34th | v2 (v2022.01.01) |
| Feb 4, 2022 | 2.17% (0.02172) | 57.15th | v2 (v2022.01.01) |
References (9)
- http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html mailing-listx_refsource_BUGTRAQ
- http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html mailing-listx_refsource_FULLDISC
- http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/ x_refsource_MISC
- http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php x_refsource_MISC
- http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php x_refsource_MISC
- http://www.f-secure.com/weblog/archives/00001949.html x_refsource_MISC
- http://www.osvdb.org/67660 vdb-entryx_refsource_OSVDB
- http://www.securityfocus.com/bid/39924 vdb-entryx_refsource_BID
- http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/ x_refsource_MISC
| Link | Providers | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html | mailing-listx_refsource_BUGTRAQ | |
| http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html | mailing-listx_refsource_FULLDISC | |
| http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk/ | x_refsource_MISC | |
| http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php | x_refsource_MISC | |
| http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php | x_refsource_MISC | |
| http://www.f-secure.com/weblog/archives/00001949.html | x_refsource_MISC | |
| http://www.osvdb.org/67660 | vdb-entryx_refsource_OSVDB | |
| http://www.securityfocus.com/bid/39924 | vdb-entryx_refsource_BID | |
| http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/ | x_refsource_MISC |
Change history (0)
No recorded changes yet.