Memory leak in Sysinternals Sysmon - #VU17211
Published: January 25, 2019
Vulnerability identifier: #VU17211
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition.
The weakness exists due to Sysmon's driver (SysmonDrv.sys) consumes new area in Nonpaged pool memory every time configuration reloads, but driver does not free old area in Nonpaged pool memory. A remote attacker can trigger memory leak and cause the service to crash.
The weakness exists due to Sysmon's driver (SysmonDrv.sys) consumes new area in Nonpaged pool memory every time configuration reloads, but driver does not free old area in Nonpaged pool memory. A remote attacker can trigger memory leak and cause the service to crash.
Affected software
Sysinternals Sysmon
Remediation
Update to versions 8.04.
Sysinternals Sysmon - update to 8.04