CVE-2017-18019

In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to compare an arbitrary memory address with a fixed value, which in turn can be used to read the contents of arbitrary memory. Similarly, the product crashes upon a \\.\K7Sentry DeviceIoControl call with an invalid kernel pointer.

CVSS v3.0

7.1 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CVSS v2.0

3.6 LOWAV:L/AC:L/Au:N/C:P/I:N/A:P

EPSS

1.24% chance of exploitation in the next 30 days, 67th percentile

Published

2018-01-04

Updated

2024-08-05

Proof-of-concept exploits (1)

• SpiralBL0CK/CVE-2017-180191★ · 2023-12-02

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/44046

References

• CVE Record
• NVD entry

Related

• CVE-2017-18016
• CVE-2017-18021
• CVE-2017-18015
• CVE-2017-18022
• CVE-2017-18012
• CVE-2017-18023