CVE-2016-9038: invincea x Race Condition

Vulnerability summary

CVE-2016-9038 is a high (CVSS 7.8) Race Condition vulnerability in invincea x. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-04-2018
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

An exploitable double fetch vulnerability exists in the SboxDrv.sys driver functionality of Invincea-X 6.1.3-24058. A specially crafted input buffer and race condition can result in kernel memory corruption, which could result in privilege escalation. An attacker needs to execute a special application locally to trigger this vulnerability.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.