Shkarko SysManager 1.52.79

[1.52.79] - 2026-07-10
Fixed
- Self-update installer had a TOCTOU (time-of-check/time-of-use) local privilege escalation window. InstallUpdateAsync verified the downloaded binary's SHA-256 hash via VerifyHashAsync (which opened and closed its own file handle) and VerifyAuthenticode (likewise), then launched the same path with Process.Start(UseShellExecute=true) — reopening the file a third time with no handle held across the verify-to-execute gap. Because the download directory is user-writable (%LOCALAPPDATA%\SysManager\updates\), a same-user process could swap the verified binary for a malicious payload in the microseconds between the final verification close and the CreateProcess open. When SysManager ran elevated (Run as Administrator), UseShellExecute=true inherited the caller's high-integrity token, giving the swapped binary admin privileges — a local elevation-of-privilege. The fix opens the downloaded file once with FileShare.Read (deny-write) before any verification begins, hashes directly from that held stream via a new VerifyHashAsync(ReleaseInfo, Stream) overload, and keeps the handle open through Process.Start. The OS allows CreateProcess to read-open the image (compatible with FileShare.Read) but blocks any write attempt while the lock is held, closing the TOCTOU window completely.
Verify the download
Get-FileHash .\SysManager-v1.52.79.exe -Algorithm SHA256
Expected SHA256: 4B31D97A2889B7DED2D448CAA8CF333A7364D2B74BC38E8148B8FEF0DF6B769E