CVE-2017-18019
HIGHK7 Total Security < 15.1.0.305 - Arbitrary Memory Read via K7Sentry Device Input
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2017-18019. PoCs published by SecuriTeam, SpiralBL0CK.
AI-analyzed exploit summary This PoC demonstrates a memory corruption vulnerability in K7 Total Security's K7Sentry driver by sending an invalid kernel pointer via an IOCTL request, leading to a PAGE_FAULT_IN_NONPAGED_AREA crash. The exploit triggers a read operation on an arbitrary memory address, potentially allowing information leakage or further exploitation.
Description
In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to compare an arbitrary memory address with a fixed value, which in turn can be used to read the contents of arbitrary memory. Similarly, the product crashes upon a \\.\K7Sentry DeviceIoControl call with an invalid kernel pointer.
Exploits (2)
This PoC demonstrates a memory corruption vulnerability in K7 Total Security's K7Sentry driver by sending an invalid kernel pointer via an IOCTL request, leading to a PAGE_FAULT_IN_NONPAGED_AREA crash. The exploit triggers a read operation on an arbitrary memory address, potentially allowing information leakage or further exploitation.
This PoC exploits CVE-2017-18019, a vulnerability in the K7Sentry.sys driver, to achieve local privilege escalation (LPE) by manipulating kernel thread objects and memory structures. The code demonstrates handle leakage, kernel address retrieval, and preparation for a ROP attack.
References (1)
Scores
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H