PT-2020-9754 · Rivet · Rivet Killer Control Center

Dhanesh Kizhakkinan · Published 2020-03-20 · Updated 2020-03-26 · CVE-2019-15662

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rivet Killer Control Center versions prior to 2.1.1352

Description An issue was discovered where IOCTL 0x120444 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation, leading to an arbitrary read primitive that can be used as part of a chain to escalate privileges.

Recommendations For Rivet Killer Control Center versions prior to 2.1.1352, update to version 2.1.1352 or later to resolve the issue. As a temporary workaround, consider restricting access to the KfeCo10X64.sys driver to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2019-15662

Affected Products

Rivet Killer Control Center

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-15662 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15662 · Vendor Advisory
• https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0006/FEYE-2019-0006.md · Note
• https://killernetworking.com · Note
• https://t.me/cvenotify/1958 · Telegram Post
• https://support.killernetworking.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf · Note