CVE-2016-4306 Information disclosure in Total Security
An unprivileged user can trigger an information leak in the Kaspersky KLDISK driver to expose kernel memory, aiding in bypassing security mitigations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-4306?
CVE-2016-4306 is a medium-severity vulnerability in Kaspersky Total Security, published on 6 Jan 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver. Specially crafted IOCTL requests can cause the driver to return out-of-bounds kernel memory, potentially leaking sensitive information such as privileged tokens or kernel memory addresses that may be useful in bypassing kernel mitigations. An unprivileged user can run a program from user-mode to trigger this vulnerability.
Weakness: CWE-200
Which versions are affected by CVE-2016-4306?
It affects 1 product.
Products include Kaspersky Total Security.
How do I fix CVE-2016-4306?
No fix has been published for CVE-2016-4306 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-4306 being exploited?
There is no known exploitation of CVE-2016-4306 in the wild and no public exploit code.
Sources
Also known as GHSA-7x8h-p499-xj9p.