CVE-2016-4306 Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver. Specially crafted IOCTL requests can cause the driver to return out-of-bounds kernel memory...
MediumCVSS 5.5
EPSS 0.66%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver. Specially crafted IOCTL requests can cause the driver to return out-of-bounds kernel memory, potentially leaking sensitive information such as privileged tokens or kernel memory addresses that may be useful in bypassing kernel mitigations. An unprivileged user can run a program from user-mode to trigger this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kaspersky total security | = 16.0.0.614 | No fix listed |
References
- 1036702 vdb-entry
- 1036703 vdb-entry
- www.talosintelligence.com exploit technical-description third-party-advisory vdb-entry
- securitytracker.com third-party-advisory vdb-entry