CVE-2009-4114: kaspersky kaspersky_anti-virus Improper Input Validation

Vulnerability summary

CVE-2009-4114 is a medium (CVSS 4.9) Improper Input Validation vulnerability in kaspersky kaspersky_anti-virus. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.9% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 30-11-2009
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463, and possibly other versions before 9.0.0.736, does not properly validate input to IOCTL 0x0022c008, which allows local users to cause a denial of service (system crash) via IOCTL requests using crafted kernel addresses that trigger memory corruption, possibly related to klavemu.kdl.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.