CVE-2018-6319

In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument

published February 2, 2018

CVSS
—
EPSS
0%
Percentile
22.7
In the wild
Unconfirmed
What it is

In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument. This argument is a memory address: if a caller passes a NULL pointer or a random invalid address, the driver will cause a Blue Screen of Death. If a program or malware does this at boot time, it can cause a persistent denial of service on the machine.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.7th percentile
Published
2018-02-02T21:00Z
EPSS history
Timeline
  • 02 FEB 21:00Z
    In Sophos Tester Tool 3.2.0.7 Beta, the driver accepts a special DeviceIoControl code that doesn't check its argument
    cvelistv5