PT-2018-17610 · Inca Internet · Nprotect Avs

Published 2018-02-02 · Updated 2018-02-21 · CVE-2018-6522

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nProtect AVS V4.0 versions prior to 4.0.0.39

Description The issue allows local users to cause a denial of service, potentially resulting in a Blue Screen of Death (BSOD), due to the driver file TKRgFtXp.SYS not validating input values from the IOCtl 0x220408. This could possibly have other unspecified impacts.

Recommendations For nProtect AVS V4.0 versions prior to 4.0.0.39, update to version 4.0.0.39 or later to resolve the issue. As a temporary workaround, consider restricting access to the TKRgFtXp.SYS driver file to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-6522

Affected Products

Nprotect Avs

References · 4

• 🔥 https://github.com/ZhiyuanWang-Chengdu-Qihoo360/nProtectAntivirus_POC/tree/master/TKRgFtXp_0x220408 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-6522 · Security Note
• http://inca.co.kr/include_file/pdf_down/nProtect%20AVS%20V4%20Vulnerability%20Response%20Release%20Notes.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-6522 · Vendor Advisory