CVE-2018-6319 Null dereference in n/a
A local attacker can cause a persistent Blue Screen of Death by passing invalid memory addresses to the Sophos Tester Tool driver.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-6319?
CVE-2018-6319 is a medium-severity vulnerability in n/a, published on 2 Feb 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument. This argument is a memory address: if a caller passes a NULL pointer or a random invalid address, the driver will cause a Blue Screen of Death. If a program or malware does this at boot time, it can cause a persistent denial of service on the machine.
Weakness: CWE-476
Which versions are affected by CVE-2018-6319?
It affects 1 product.
Products include Sophos Sophos Tester.
How do I fix CVE-2018-6319?
No fix has been published for CVE-2018-6319 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-6319 being exploited?
There is no known exploitation of CVE-2018-6319 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-x4pf-c598-7qg2.