PT-2024-17138 · Netskope · Netskope Endpoint Dlp

Thomas Brice · Published 2024-12-19 · Updated 2024-12-19 · CVE-2024-11616

Positive Technologies (AI Summary)

CVSS v4.0

5.6

Medium

Base vector

AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Netskope Endpoint DLP versions prior to R119

Description A security issue arises from a double-fetch problem in the Content Control Driver of Netskope Endpoint DLP, leading to a heap overflow. This occurs because the NumberOfBytes argument to ExAllocatePoolWithTag and the Length argument for RtlCopyMemory both independently dereference their value from the user-supplied input buffer inside the EpdlpSetUsbAction function. If the length value increases between these two calls, it results in the RtlCopyMemory call copying user-supplied memory contents outside the allocated buffer, causing a heap overflow. An attacker needs admin privileges to exploit this issue.

Recommendations For versions prior to R119, update to version R119 or later to resolve the issue. As a temporary workaround, consider restricting access to the EpdlpSetUsbAction function until a patch is available. Additionally, ensure that only trusted users have admin privileges to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-11616

Affected Products

Netskope Endpoint Dlp

References · 7

• https://netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2024-003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11616 · Security Note
• https://inbits-sec.com/posts/cve-2024-11616-netskope · Note
• https://t.me/cvenotify/104872 · Telegram Post
• https://t.me/cvedetector/13316 · Telegram Post
• https://twitter.com/CVEnew/status/1869688098277531702 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1869693608510509415 · Twitter Post