PT-2020-9755 · Rivet · Rivet Killer Control Center

Published 2020-03-20 · Updated 2020-03-26 · CVE-2019-15663

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rivet Killer Control Center versions prior to 2.1.1352

Description An issue was discovered in Rivet Killer Control Center where IOCTL 0x120404 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation, leading to an out-of-bounds read that can be used as part of a chain to escalate privileges.

Recommendations For versions prior to 2.1.1352, update to version 2.1.1352 or later to resolve the issue. As a temporary workaround, consider restricting access to the KfeCo10X64.sys driver to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2019-15663

Affected Products

Rivet Killer Control Center

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-15663 · Security Note
• https://support.killernetworking.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15663 · Vendor Advisory
• https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0007/FEYE-2019-0007.md · Note
• https://killernetworking.com · Note
• https://t.me/cvenotify/1959 · Telegram Post