PT-2019-11513 · Truecrypt Foundation+1 · Truecrypt+1

Tim Harrison · Published 2019-07-23 · Updated 2021-02-19 · CVE-2019-1010208

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Veracrypt versions prior to 1.23-Hotfix-1 Truecrypt all versions

Description: The issue is related to a buffer overflow in the Veracrypt NT Driver (veracrypt.sys) component, which can lead to minor information disclosure of the kernel stack. This can be exploited through locally executed code by sending an IOCTL request to the driver.

Recommendations: For Veracrypt versions prior to 1.23-Hotfix-1, update to version 1.23-Hotfix-1 to resolve the issue. For Truecrypt, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the Veracrypt NT Driver (veracrypt.sys) to minimize the risk of exploitation.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2019-1010208

MGASA-2021-0088

Affected Products

Truecrypt

Veracrypt

References · 6

• https://github.com/veracrypt/VeraCrypt/commit/f30f9339c9a0b9bbcc6f5ad38804af39db1f479e · Patch
• https://osv.dev/vulnerability/CVE-2019-1010208 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0088 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0088.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010208 · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=28078 · Note