CVE-2016-4306: kaspersky total_security

Vulnerability summary

CVE-2016-4306 is a medium (CVSS 5.5) vulnerability in kaspersky total_security. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-01-2017
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver. Specially crafted IOCTL requests can cause the driver to return out-of-bounds kernel memory, potentially leaking sensitive information such as privileged tokens or kernel memory addresses that may be useful in bypassing kernel mitigations. An unprivileged user can run a program from user-mode to trigger this vulnerability.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.