CVE-2007-5086 in Kaspersky
Summary
by MITRE
Kaspersky Anti-Virus (KAV) and Internet Security 7.0 build 125 do not properly validate certain parameters to System Service Descriptor Table (SSDT) and Shadow SSDT function handlers, which allows local users to cause a denial of service (crash) via the (1) NtUserSendInput, (2) LoadLibraryA, (3) NtOpenProcess, (4) NtOpenThread, (5) NtTerminateProcess, (6) NtUserFindWindowEx, and (7) NtUserBuildHwndList kernel SSDT hooks in kylif.sys; the (8) NtDuplicateObject (DuplicateHandle) kernel SSDT hook; and possibly other kernel SSDT hooks. NOTE: the NtCreateSection vector is covered by CVE-2007-5043.1. NOTE: the vendor disputes that the DuplicateHandle vector is a vulnerability in their code, stating that "it is not an error in our code, but an obscure method for manipulating standard Windows routines to circumvent our self-defense mechanisms."
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/23/2018
The vulnerability described in CVE-2007-5086 represents a critical flaw in Kaspersky Anti-Virus and Internet Security 7.0 build 125 that stems from improper parameter validation within kernel-level system service descriptor table handlers. This issue affects the kylif.sys driver component which serves as the core kernel-mode protection layer for Kaspersky's security suite. The vulnerability specifically targets multiple kernel SSDT hooks that intercept and monitor system calls, creating a potential attack surface that could be exploited by local malicious actors to disrupt system operations. The affected functions include NtUserSendInput, LoadLibraryA, NtOpenProcess, NtOpenThread, NtTerminateProcess, NtUserFindWindowEx, and NtUserBuildHwndList, all of which are critical user-mode and kernel-mode system calls that form the foundation of Windows operating system functionality. The vulnerability also encompasses the NtDuplicateObject (DuplicateHandle) kernel SSDT hook, which is particularly significant as it handles object duplication operations within the Windows kernel.
The technical implementation of this vulnerability lies in the insufficient validation of parameters passed to kernel-mode service handlers within the Kaspersky security driver. When these system calls are intercepted and processed by the kylif.sys driver, the software fails to properly validate input parameters, leading to potential buffer overflows, invalid memory access, or other memory corruption conditions. This validation failure occurs specifically within the shadow SSDT function handlers that Kaspersky employs for enhanced system monitoring and protection. The vulnerability manifests as a denial of service condition that can cause system crashes or complete system instability. The flaw essentially allows local users to craft malicious parameter inputs that, when processed through these kernel hooks, trigger unexpected behavior in the security driver, resulting in system termination or unresponsive states. This represents a classic example of improper input validation in kernel-mode code, which can have catastrophic consequences for system stability and security.
From an operational impact perspective, this vulnerability creates significant risks for organizations relying on Kaspersky security solutions, as local attackers can exploit these weaknesses to cause system-wide disruptions. The denial of service condition affects critical system functionality, potentially rendering security protections ineffective during the attack window. The vulnerability's impact extends beyond simple system crashes to potentially compromise the integrity of the security stack itself, as the kernel-mode components that protect against malware and other threats become unstable or unavailable. Organizations may experience unexpected system downtime, reduced security coverage, and potential escalation of attacks that could otherwise be prevented by the security solution. The vulnerability affects the fundamental stability of the operating system when Kaspersky's protection mechanisms are actively engaged, creating a paradoxical situation where the security software becomes a source of instability rather than protection.
The mitigation strategies for this vulnerability should focus on immediate patching and updating of affected Kaspersky products to the latest available versions that contain proper parameter validation fixes. System administrators should ensure that all Kaspersky security solutions are updated to versions that address these kernel-mode validation issues. Additionally, monitoring for suspicious system behavior or kernel-level anomalies that could indicate exploitation attempts should be implemented. The vulnerability aligns with CWE-129, which addresses improper validation of input ranges, and CWE-131, which covers improper handling of buffer size. From an ATT&CK framework perspective, this vulnerability maps to T1059.003 for system service manipulation and T1490 for denial of service attacks. Organizations should also consider implementing additional security monitoring to detect potential exploitation attempts through kernel-mode hook manipulation, as the vulnerability specifically targets the interception and processing of system calls that form the foundation of Windows security architecture. The vendor's statement regarding the DuplicateHandle vector indicates that some aspects of this vulnerability may be intentionally designed to circumvent protection mechanisms, suggesting that the security architecture itself may require additional scrutiny and hardening.