PT-2020-9757 · Rivet · Rivet Killer Control Center

Published 2020-03-20 · Updated 2020-03-26 · CVE-2019-15665

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rivet Killer Control Center versions prior to 2.1.1352

Description An issue was discovered in Rivet Killer Control Center where IOCTL 0x120004 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation, leading to an arbitrary write primitive that can lead to code execution or escalation of privileges.

Recommendations For versions prior to 2.1.1352, update to version 2.1.1352 or later to resolve the issue. As a temporary workaround, consider restricting access to the KfeCo10X64.sys driver to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-15665

Affected Products

Rivet Killer Control Center

References · 6

• https://osv.dev/vulnerability/CVE-2019-15665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15665 · Security Note
• https://support.killernetworking.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf · Vendor Advisory
• https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0009/FEYE-2019-0009.md · Note
• https://t.me/cvenotify/1961 · Telegram Post
• https://killernetworking.com · Note