CVE-2009-4114

Kaspersky AV 2010 9.0.0.463 - Local Denial of Service

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-4114 has a selected CVSS score of 4.9; EIP currently links 1 catalogued exploit.

Description

kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463, and possibly other versions before 9.0.0.736, does not properly validate input to IOCTL 0x0022c008, which allows local users to cause a denial of service (system crash) via IOCTL requests using crafted kernel addresses that trigger memory corruption, possibly related to klavemu.kdl.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBKaspersky AV 2010 9.0.0.463 - Local Denial of ServiceExploitDB exploitby HeursExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a C program that triggers a denial-of-service vulnerability in Kaspersky Anti-Virus 2010 by sending a crafted IOCTL request to the kimul25 device driver, causing a system crash (BSOD).

Backdoor review

No backdoor observed in reviewed code

The provided C source code is a straightforward local denial-of-service proof-of-concept for CVE-2009-4114. It opens the Kaspersky device driver 'kimul25' and sends a crafted IOCTL to trigger a system crash. No backdoor, unauthorized access, data exfiltration, or other hidden malicious functionality is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesC
Target softwareKaspersky Anti-Virus 2010 9.0.0.463
Attack typesDenial of Service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively sends a malicious IOCTL request to a vulnerable driver to cause a system crash, which is the definition of an exploit. It does not merely scan or detect the vulnerability.

exploits/windows/dos/10164.c:26-28exploits/windows/dos/10164.c:57-59

Requirements

  • Kaspersky Anti-Virus 2010 9.0.0.463 must be installed with the vulnerable kl1.sys driver loaded.exploits/windows/dos/10164.c:8
  • The attacker must have local access to the system to execute the program.exploits/windows/dos/10164.c:1-65

Observed behavior

  • Opens a handle to the device \\.\kimul25 with read/write access.exploits/windows/dos/10164.c:57
  • Sends a crafted IOCTL request (0x0022c008) with a specific DWORD array to the device, triggering a system crash (BSOD).exploits/windows/dos/10164.c:59
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Operation
Payload withheldOpens a handle to the vulnerable Kaspersky device driver to send the exploit payload.exploits/windows/dos/10164.c:57
Ioctl Call
Payload withheldSends the crafted DWORD array to the vulnerable IOCTL code 0x0022c008 to trigger the denial-of-service condition.exploits/windows/dos/10164.c:59
Payload Data
Payload withheldThe array of DWORDs passed to the vulnerable IOCTL. These are crafted to cause a crash (BSOD) in the driver, not to perform any backdoor or unauthorized action.exploits/windows/dos/10164.c:48-53
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the provided source code; no external dependencies or runtime behavior were examined.
  • The code is a local denial-of-service exploit and does not achieve code execution or privilege escalation.
  • Only the supplied source code was reviewed; no binary analysis was performed.
  • The payload array is opaque but is consistent with the described crash trigger and shows no evidence of backdoor functionality.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

9