PT-2015-2676 · Microsoft · Windows 10+4

Published 2015-11-10 · Updated 2019-05-15 · CVE-2015-6109

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows 8.1 Windows Server 2012 R2 Windows RT 8.1 Windows 10 Gold Windows 10 version 1511

Description The issue allows local users to bypass the KASLR protection mechanism and discover a driver base address via a crafted application. This is due to the kernel in Windows failing to properly initialize memory addresses, allowing an attacker to retrieve information. An attacker who successfully exploits this issue could retrieve the base address of the Kernel driver from a compromised process. To exploit the issue, an attacker would have to log on to an affected system and run a specially crafted application.

Recommendations For Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, and Windows 10 version 1511, update to a newer version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-12041

CVE-2015-6109

Affected Products

Windows

Windows 10

Windows 8.1

Windows Rt 8.1

Windows Server 2012 R2

References · 7

• https://bdu.fstec.ru/vul/2015-12041 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-115 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6109 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6109 · Security Note
• http://technet.microsoft.com/security/bulletin/ms15-115 · Note
• http://securitytracker.com/id/1034114 · Note
• http://technet.microsoft.com/security/bulletin/MS15-115 · Note