Kernel Memory Pool Vulnerability in IObit Smart Defrag by IObit
CVE-2019-6493

5.5MEDIUM

Key Information:

Vendor

Iobit

Status
Smart Defrag
Vendor
CVE Published:
11 April 2019

What is CVE-2019-6493?

A vulnerability exists in IObit Smart Defrag where the SmartDefragDriver.sys does not properly manage kernel memory, potentially leaking kernel pointers. When the IOCTL 0x9C401CC0 command is issued, the driver allocates a user-defined size for the kernel pool but fails to release it, leading to a scenario where the allocated memory could grow excessively large. This flaw raises concerns about memory management and stability within the Windows operating system.

References

https://downwithup.github.io/CVEPosts.html
x_refsource_MISC
https://www.iobit.com/en/iobitsmartdefrag.php
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.