ZDI-CAN-6369: Trend Micro Anti-Virus ctl_set KERedirect Untrusted Pointer Dereference Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Trend Micro Anti-Virus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the function ctlset KERedirect kext. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the kernel.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-6369?
The severity of ZDI-CAN-6369 is high, as it allows local privilege escalation.
How do I fix ZDI-CAN-6369?
To fix ZDI-CAN-6369, ensure that you update your Trend Micro Anti-Virus to the latest version provided by the vendor.
Who is affected by ZDI-CAN-6369?
ZDI-CAN-6369 affects installations of Trend Micro Anti-Virus that have not been updated.
Can ZDI-CAN-6369 be exploited remotely?
No, ZDI-CAN-6369 requires local access to the system to exploit the vulnerability.
What are the potential impacts of exploiting ZDI-CAN-6369?
Exploiting ZDI-CAN-6369 can allow an attacker to gain elevated privileges on the affected system.