Lack of validation on data read from guest memory in Bitdefender HVI (VA-9333)
CVE-2020-15292

5.5MEDIUM

Key Information:

Vendor

Bitdefender

Status
Hypervisor Introspection
Vendor
CVE Published:
17 December 2020

What is CVE-2020-15292?

Lack of validation on data read from guest memory in IntPeGetDirectory, IntPeParseUnwindData, IntLogExceptionRecord, IntKsymExpandSymbol and IntLixTaskDumpTree may lead to out-of-bounds read or it could cause DoS due to integer-overflor (IntPeGetDirectory), TOCTOU (IntPeParseUnwindData) or insufficient validations.

Affected Version(s)

Hypervisor Introspection < 1.132.2

References

https://www.bitdefender.com/support/security-advisories/l...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ilja Van Sprundel from IOActive
.