CVE-2023-XXXXX: Critical Windows Defender DoS Vulnerability Patched

Key Takeaways

• A new proof-of-concept (PoC) tool, “BigDiskBuster,” has been released, capable of preventing Microsoft Defender Antivirus from successfully updating.
• The technique exploits a denial-of-service (DoS) vulnerability by exhausting disk space and locking critical files during Defender’s update process.
• This vulnerability, if exploited, could leave Windows endpoints with outdated security definitions, making them susceptible to new threats despite appearing protected.
• While the PoC is experimental, administrators should monitor for unusual disk activity, hidden temporary files, and persistent Defender update failures.

New PoC Tool Disrupts Windows Defender Updates via DoS Attack

A cybersecurity researcher, known as MSNightmare (or Nightmare-Eclipse), has unveiled a proof-of-concept (PoC) tool named “BigDiskBuster.” This tool is engineered to trigger a denial-of-service (DoS) condition in Microsoft Defender Antivirus, specifically designed to halt the completion of both platform and security-intelligence updates. The researcher presents BigDiskBuster as a successor to a previous project, “UnDefend.”

How BigDiskBuster Operates

BigDiskBuster does not directly disable Defender. Instead, it employs a sophisticated method to interfere with the update mechanism. The PoC monitors the C: drive for activity related to Defender’s Platform and Definition Updates directories. When the system attempts to create a new update directory, BigDiskBuster intervenes.

The program calculates the remaining free disk space and then creates a hidden, temporary file within the user’s temporary directory. This file is configured to delete on close and requests the entirety of the available free space. Should any files be modified or removed during the update attempt, additional worker threads are activated to continuously reclaim newly available capacity, effectively starving the update installer of necessary storage.

In addition to disk exhaustion, the PoC also opens the Malicious Software Removal Tool (MRT.exe) binary with highly restrictive sharing permissions. This maneuver prevents other processes from gaining write or delete access to the file while BigDiskBuster maintains its handle, further disrupting the update process.

The combined effect of disk space exhaustion and file locking actively obstructs the staging, installation, and rollback operations of Defender updates. Once the monitored Defender update directory vanishes (indicating a failed update), BigDiskBuster closes its temporary file handles and releases the allocated disk space.

A screenshot accompanying the disclosure illustrates Windows Security reporting “Protection definition update failed” with error code 0x80070643, indicating a fatal installation error. Concurrently, the console logs show BigDiskBuster detecting an update and allocating temporary files. This shows the researcher’s test, not independent confirmation. It’s important to note that error 0x80070643 is a generic installation failure code with multiple potential causes, so its presence alone should not be interpreted as definitive proof of exploitation.

Significant Security Implications

The security implications of BigDiskBuster are substantial. Microsoft Defender relies on a continuous stream of separate security-intelligence, engine, and platform updates. Microsoft emphasizes that intelligence packages deliver crucial detection content, while platform and engine releases maintain the antivirus components. Interrupting these update channels could leave an endpoint with seemingly active protection, while its actual ability to detect and mitigate emerging malware steadily degrades over time.

What You Should Do

• Monitor Disk Space: Watch for sudden and significant collapses in free disk space, particularly on the C: volume.
• Inspect Temporary Directories: Look for unusual hidden files being created in user temporary directories.
• Check File Handles: Monitor for persistent open handles to MRT.exe that are not associated with legitimate system processes.
• Track Defender Update Status: Pay close attention to repeated or recurring failures of Microsoft Defender updates. Microsoft logs update events in Applications and Services Logs under Microsoft, Windows, Windows Defender, Operational. Event ID 2000 typically records a successful signature update; therefore, missing successes and recurring failures are crucial indicators.
• Validate and Investigate: Given that BigDiskBuster is an experimental PoC, avoid treating every Defender update error as an attack. Validate any affected hosts, preserve process and file-handle telemetry for forensic analysis, terminate any suspicious processes, recover disk capacity, and then force a trusted update through Windows Update, WSUS, the Windows Security app, or MpCmdRun.exe.
• Broader Incident Response: For any confirmed compromised systems, initiate a comprehensive incident response review beyond just addressing the update issue.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.