Critical Comodo Internet Security Flaw Lets Attackers Crash Windows Systems

Key Takeaways

• A zero-day vulnerability, dubbed “ComoDoS,” has been publicly disclosed in Comodo Internet Security’s firewall driver, Inspect.sys.
• The flaw allows a remote attacker to trigger a denial-of-service (DoS) condition, crashing target Windows systems with a specially crafted IPv6 packet.
• Despite multiple attempts by researcher Marcus Hutchins to notify Comodo, no patch has been released, leaving users exposed.
• The vulnerability bypasses all firewall rules because the malicious packet is parsed at the kernel level before rules are applied.

Comodo Internet Security Zero-Day Disclosed: Windows Systems at Risk

An unpatched zero-day vulnerability in the firewall driver of Comodo Internet Security, identified as Inspect.sys, has been publicly revealed after repeated attempts to contact the vendor yielded no response. This critical flaw, still without a fix, enables attackers to achieve significant system disruption, presenting a severe threat to users.

The vulnerability, named ComoDoS by its discoverer Marcus Hutchins, allows a remote attacker to initiate a system crash on a target Windows machine using a single, malformed IPv6 packet. This attack effectively circumvents all existing firewall configurations.

As of the time of this report, no official patch from Comodo is available. Marcus Hutchins provided Comodo’s security team with a comprehensive root-cause analysis, suggested patch modifications, and a proof-of-concept (PoC) exploit, but received no acknowledgment.

Technical Deep Dive into the ComoDoS Vulnerability

The core of the flaw resides within Inspect.sys’s IPv6 header parser. IPv6 packets are designed to support optional “extension headers” that form a chain between the fixed 40-byte IPv6 header and the subsequent upper-layer protocol, such as TCP or UDP.

During the parsing process, the driver iterates through these extension headers. For each header, its length is subtracted from a payload_length variable, which is directly derived from the IPv6 fixed header and can be manipulated by an attacker.

The critical oversight is the absence of validation for the payload_length field. Should an attacker specify an IPv6 payload length that is smaller than the combined length of the extension headers, the unsigned 64-bit payload_length variable undergoes an integer underflow. This causes it to wrap around to an extremely large value, approximately 18.4 quintillion (0xFFFFFFFFFFFFFFF8).

Crucially, this parsing operation occurs at the kernel level, preceding any firewall rule enforcement. Consequently, the vulnerability can be triggered regardless of whether all ports are configured to be blocked by the firewall.

The resulting integer underflow triggers a kernel crash, manifesting as a Blue Screen of Death (BSOD), making it a highly reliable remote denial-of-service primitive. The PoC exploit is remarkably concise, requiring only four lines of Python code utilizing the Scapy library:

ext = IPv6ExtHdrDestOpt(nh=6, options=[PadN(optdata=b"x00" * 8)])
tcp = TCP(sport=1337, dport=80, flags="S", seq=0, ack=1, window=0x2000)
ipv6 = IPv6(dst=dst_ip, nh=60, hlim=64, plen=8)
pkt = ipv6 / ext / tcp
send(packet)

Marcus Hutchins specifically chose the Destination Options extension header (type 60) for the PoC. This header type is known to be subjected to the least amount of filtering by routers, thereby maximizing the probability that the malicious packet successfully reaches its intended target across the internet.

Beyond Denial-of-Service: Potential for Further Exploitation

While the primary impact is a DoS, Marcus Hutchins also identified accessible out-of-bounds (OOB) read and write paths that are triggered by the same underflowed value. However, exploiting these primitives for more severe outcomes, such as remote code execution (RCE), faces significant technical challenges.

The OOB-read occurs within a WebDAV/HTTP artifact scanner. In this context, the size value is truncated to 16-bit, limiting it to 65 KB. A page fault in this execution path leads to a system crash at DISPATCH_LEVEL.

The OOB-write, which can only be reached after a complete TCP handshake, truncates the underflowed size to 32-bit. This results in a 4 GB kernel pool overflow, almost certainly guaranteeing a system crash. Given that standard network packets are capped at 65 KB, it is not practically feasible to reduce the size of the overflow sufficiently to prevent a crash, rendering remote code execution highly improbable at this juncture.

This vulnerability was discovered during research into BYOVD (Bring Your Own Vulnerable Driver) attack surfaces, employing an AI-assisted analysis pipeline. Marcus Hutchins’ research into older Comodo driver versions revealed architectural weaknesses that prompted a manual analysis of the current driver, directly leading to this discovery.

A complete PoC is publicly available on GitHub.

What You Should Do

• Organizations and individuals utilizing Comodo Internet Security should implement network-level controls to block malformed IPv6 extension headers as a temporary mitigation strategy.
• Monitor network traffic for any anomalous IPv6 packets.
• Stay vigilant for an official patch release from Comodo and apply it immediately once available.
• Consider alternative security solutions if Comodo fails to provide a timely fix, particularly for critical systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.