CVE-2015-8579 in Total Security 2015
Summary
by MITRE
Kaspersky Total Security 2015 15.0.2.361 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/07/2018
Kaspersky Total Security 2015 version 15.0.2.361 contains a critical memory management vulnerability that fundamentally undermines modern operating system security protections. This flaw exists within the software's kernel-mode drivers responsible for process protection and memory management. The vulnerability stems from the improper allocation of memory pages with Read, Write, and Execute permissions simultaneously, creating a dangerous RWX memory segment that can be exploited by malicious actors. The predictable memory addresses where these RWX pages are allocated provide attackers with the precise locations needed to execute their payloads effectively.
The technical implementation of this vulnerability directly violates fundamental security principles established by operating system designers and security frameworks. When Kaspersky's protection mechanisms allocate memory with RWX permissions, they create an environment where malicious code can be injected and executed without triggering the standard security checks that are designed to prevent such activities. The predictable nature of these memory addresses means that attackers can reliably locate and utilize these vulnerable memory regions, effectively neutralizing both Data Execution Prevention and Address Space Layout Randomization protections. This vulnerability operates at the kernel level, making it particularly dangerous as it can bypass user-mode security controls and directly compromise system integrity.
The operational impact of this vulnerability extends far beyond simple privilege escalation or code execution. Attackers can leverage this flaw to bypass multiple security layers simultaneously, including DEP which prevents code execution in data pages and ASLR which randomizes memory layout to prevent predictable exploitation. The vulnerability essentially creates a backdoor within the security software itself, turning the protective mechanisms into attack vectors. This type of vulnerability is particularly concerning because it affects security software that is designed to protect against precisely these types of attacks, creating a paradoxical situation where the defense becomes the offense. The attack surface is broad as any process running under Kaspersky's protection could potentially be targeted, making this a widespread threat across various system components and user activities.
The exploitation of this vulnerability aligns with several tactics described in the MITRE ATT&CK framework, particularly those related to privilege escalation and defense evasion techniques. The flaw enables adversaries to execute malicious code in kernel mode, which maps to techniques such as kernel-mode rootkits and driver-based attacks. Additionally, the bypass of DEP and ASLR protections corresponds to evasion techniques that target memory protection mechanisms. Organizations using Kaspersky Total Security 2015 should immediately implement mitigations including disabling the affected protection features, updating to patched versions, and monitoring for suspicious memory allocation patterns. The vulnerability also highlights the importance of proper memory management practices in security software, as outlined in CWE-123 which addresses weaknesses in memory allocation and protection. System administrators should consider implementing additional monitoring for kernel-mode memory operations and establish incident response procedures specifically addressing potential exploitation of this type of vulnerability.