Full Disclosure

McAfee File Lock Driver – Kernel Memory Leak

Posted by Kyriakos Economou on Jan 27

* CVE: CVE-2015-8772
* Vendor: McAfee – Intel Security
* Reported by: Kyriakos Economou
* Date of Release: 26/01/2016
* Date of Fix: N/A
* Affected Products: Multiple
* Affected Version: McPvDrv.sys v4.6.111.0
* Fixed Version: N/A

Description:
McAfee File Lock Driver does not handle correctly IOCTL_DISK_VERIFY IOCTL requests, which leads to kernel memory leak
through specifically crafted IOCTLs. Normally the IOCTL_DISK_VERIFY IOCTL is used to…