CVE-2017-6008 in SurfRight HitmanPro
Summary
by MITRE
A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean) allows local users to escalate privileges via a malformed IOCTL call.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/15/2019
The vulnerability identified as CVE-2017-6008 represents a critical kernel pool overflow condition affecting the Sophos SurfRight HitmanPro software suite, specifically within the hitmanpro37.sys driver component. This flaw exists in versions prior to 3.7.20 Build 286 and impacts both the HitmanPro.Alert solution and Sophos Clean products. The vulnerability stems from inadequate input validation within the driver's handling of Device Control Interface (IOCTL) requests, creating a scenario where maliciously crafted IOCTL calls can trigger memory corruption in the kernel pool memory space. The affected driver component is responsible for system-level security operations and typically operates with elevated privileges, making this vulnerability particularly dangerous for privilege escalation attacks.
The technical implementation of this vulnerability involves a classic buffer overflow scenario within kernel space memory management. When the hitmanpro37.sys driver receives a malformed IOCTL request, it fails to properly validate the size or content of the input data structure, leading to a situation where user-supplied data can overwrite adjacent memory locations in the kernel pool. This memory corruption can result in arbitrary code execution within kernel context, allowing local attackers to elevate their privileges from standard user level to system-level access. The vulnerability specifically manifests through improper bounds checking during IOCTL parameter processing, where the driver does not adequately verify that the input data fits within the allocated memory buffer before copying data into kernel memory space. This flaw directly corresponds to CWE-121, which describes stack-based buffer overflow conditions, and CWE-122, which addresses heap-based buffer overflow scenarios that can occur in kernel-mode drivers.
The operational impact of CVE-2017-6008 extends beyond simple privilege escalation, as it provides attackers with a pathway to achieve complete system compromise through kernel-level access. Local users who can execute code on the target system can leverage this vulnerability to bypass standard operating system security mechanisms, including User Access Control and privilege separation models. Once successfully exploited, the attacker gains the ability to modify system files, install malicious software, access sensitive data, and potentially establish persistent backdoors. The vulnerability's exploitation requires local access to the system, making it less suitable for remote attacks but still highly dangerous in scenarios where an attacker already has user-level access or can trick users into executing malicious code. From an attack framework perspective, this vulnerability aligns with techniques described in the MITRE ATT&CK framework under the privilege escalation tactics, specifically targeting the 'Kernel Modules and Driver' technique where adversaries manipulate kernel components to gain elevated privileges.
Mitigation strategies for CVE-2017-6008 primarily focus on immediate software updates and system hardening measures. The most effective remediation involves upgrading to Sophos SurfRight HitmanPro version 3.7.20 Build 286 or later, which includes proper input validation and memory boundary checking within the affected driver component. System administrators should also implement additional security controls such as disabling unnecessary driver services, applying kernel patching mechanisms, and monitoring for suspicious IOCTL activity through endpoint detection and response solutions. The vulnerability demonstrates the importance of proper kernel driver security practices and input validation, as outlined in security standards such as the CERT Secure Coding Standards for kernel-mode drivers and Microsoft's Windows Driver Framework security guidelines. Organizations should also consider implementing application whitelisting policies to prevent exploitation through unauthorized driver loading and establish comprehensive monitoring for unusual system behavior that might indicate kernel-level compromise.