Privilege escalation in Macrovision SafeDisc driver for Windows

Published: 2018-03-01

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2018-7250 CVE-2018-7249
CWE-ID	CWE-200 CWE-416
Exploitation vector	Local
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	Windows Operating systems & Components / Operating system
Vendor	Microsoft

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU10788

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-7250

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to uninitialized kernel pool allocation in IOCTL 0xCA002813 in secdrv.sys in Macrovision SafeDisc. A local attacker can send a specially-crafted request and obtain 16 bits of uninitialized kernel PagedPool data.

Mitigation

Refer to Microsoft Security Bulletin MS15-097 for patch, upgrade or suggested workaround information.

Vulnerable software versions

Windows: 7 - Vista

External links

http://github.com/Elvin9/SecDrvPoolLeak/blob/master/README.md
http://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-097

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Privilege escalation

EUVDB-ID: #VU10789

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-7249

CWE-ID: CWE-416 - Use After Free