PT-2019-18116 · Iobit · Iobit Smart Defrag

Publicado 2019-04-11 · Atualizado 2020-08-24 · CVE-2019-6493

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IObit Smart Defrag version 6

Description The issue concerns the SmartDefragDriver.sys (2.0) in IObit Smart Defrag 6, where an executable kernel pool allocated with user-defined bytes and size is not freed when a specific IOCTL (0x9C401CC0) is called. This can lead to a kernel pointer leak if the kernel pool becomes a "big" pool.

Recommendations For IObit Smart Defrag version 6, consider disabling the IOCTL 0x9C401CC0 call as a temporary workaround until a patch is available. Restrict access to the SmartDefragDriver.sys module to minimize the risk of exploitation. Avoid using the IOCTL 0x9C401CC0 in the affected driver until the issue is resolved.

Exploit

Correção

Memory Leak

Enumeração de Fraquezas

CWE-401

Identificadores relacionados

CVE-2019-6493

Produtos afetados

Iobit Smart Defrag

Referências · 4

• 🔥 https://downwithup.github.io/CVEPosts.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-6493 · Nota de Segurança
• https://iobit.com/en/iobitsmartdefrag.php · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-6493 · Aviso do Fabricante