PT-2022-2171 · Kingsoft · Kingsoft Internet Security 9 Plus

Satoshi Tanda · Published 2022-01-06 · Updated 2022-03-23 · CVE-2022-25949

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KINGSOFT Internet Security 9 Plus version 2010.06.23.247

Description The issue is related to the kernel mode driver kwatch3, which fails to properly handle crafted inputs. This failure leads to a stack-based buffer overflow. The exploitation of this issue may allow an attacker to execute arbitrary code.

Recommendations For KINGSOFT Internet Security 9 Plus version 2010.06.23.247, consider disabling the kwatch3 driver as a temporary workaround until a patch is available. Restrict access to the kwatch3 driver to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2022-02182

CVE-2022-25949

Affected Products

Kingsoft Internet Security 9 Plus

References · 9

• 🔥 https://github.com/tandasat/CVE-2022-25949 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25949 · Security Note
• https://support.kingsoft.jp/support-info/weakness.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25949 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02182 · Security Note
• https://t.me/cibsecurity/39166 · Telegram Post
• https://virustotal.com/gui/file/ffdedbaeccbcf0b697675b24ca313cbb8e1c9ba1bd2f0a0b58a2d6a04a038479/details · Note
• https://jvn.jp/en/jp/JVN21234459 · Note
• https://cybersecurity-help.cz/vdb/SB2022031605 · Note