CVE-2009-4114

kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463, and possibly other versions before 9.0.0.736, does not properly validate input to IOCTL 0x0022c008, which allows local users to cause a denial of service (system crash) via IOCTL requests using crafted kernel addresses that trigger memory corruption, possibly related to klavemu.kdl.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.9 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:N/C:N/I:N/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 58%
VendorProductVersion
kasperskykaspersky_anti-virus
9.0.0.463
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/60207
http://secunia.com/advisories/37398
http://sysdream.com/article.php?story_id=323&section_id=78
http://www.securityfocus.com/archive/1/507933/100/0/threaded
http://www.securityfocus.com/bid/37044
http://www.securitytracker.com/id?1023198
http://www.vupen.com/english/advisories/2009/3286
https://exchange.xforce.ibmcloud.com/vulnerabilities/54309
http://osvdb.org/60207
http://secunia.com/advisories/37398
http://sysdream.com/article.php?story_id=323&section_id=78
http://www.securityfocus.com/archive/1/507933/100/0/threaded
http://www.securityfocus.com/bid/37044
http://www.securitytracker.com/id?1023198
http://www.vupen.com/english/advisories/2009/3286
https://exchange.xforce.ibmcloud.com/vulnerabilities/54309