CVE-2008-4363
DESlock+ 3.2.7 - Denial of Service via DLMFENC_IOCTL Request
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-4363. PoCs published by mu-b.
AI-analyzed exploit summary This exploit demonstrates a local kernel race condition in DESlock+ <= 3.2.7 by repeatedly allocating and freeing memory while issuing IOCTL requests to trigger a DoS. The race condition occurs between ProbeForRead/ProbeForWrite calls and pointer usage in the DLMFENC.sys driver.
Description
DLMFENC.sys 1.0.0.28 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) or potentially execute arbitrary code via a certain DLMFENC_IOCTL request to \\.\DLKPFSD_Device that overwrites a pointer, probably related to use of the ProbeForRead function when ProbeForWrite was intended.
Exploits (2)
This exploit demonstrates a local kernel race condition in DESlock+ <= 3.2.7 by repeatedly allocating and freeing memory while issuing IOCTL requests to trigger a DoS. The race condition occurs between ProbeForRead/ProbeForWrite calls and pointer usage in the DLMFENC.sys driver.
This exploit targets a local kernel DoS vulnerability in DESlock+ <= 3.2.7 by sending a malformed IOCTL request to the DLKPFSD_Device driver, causing a call to ProbeForRead with a user-definable address. The PoC allocates a read-only memory page and triggers the vulnerability via DeviceIoControl.