Login Request a demo
Medium severity · published Jan 6, 2017
CVE-2016-4306
Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver
5.5
CVSS
0.7%
EPSS
No
On KEV
Description
Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver. Specially crafted IOCTL requests can cause the driver to return out-of-bounds kernel memory, potentially leaking sensitive information such as privileged tokens or kernel memory addresses that may be useful in bypassing kernel mitigations. An unprivileged user can run a program from user-mode to trigger this vulnerability.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Total Security · Kaspersky
16.0.0.614 · source: NVD
Affected product
TS
Total Security
Kaspersky
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4306
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4306
www.securitytracker.com
http://www.securitytracker.com/id/1036702
www.securitytracker.com
http://www.securitytracker.com/id/1036703
Exploit
http://www.talosintelligence.com/reports/TALOS-2016-0168/
Third Party Advisory
http://securitytracker.com/id/1036702
More from Total Security
9.8
CVE-2022-27534
Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially…
6.7
CVE-2019-15689
Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E have bug that allows a local user to…
6.5
CVE-2019-15687
Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the…
6.1
CVE-2019-15688
Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the…
5.5
CVE-2021-27223
A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security