Design/Logic Flaw

HWiNFO AMD64 Kernel driver version 8.98 and lower allows an unprivileged user to send an IOCTL to the device driver. If input and/or output buffer pointers are NULL or if these buffers' data are invalid, a NULL/invalid pointer access occurs, resulting in a Windows kernel panic aka Blue Screen. Th...

kernel: Use-after-free in snd_seq_ioctl_create_port()

A use-after-free vulnerability was found when issuing an ioctl to a sound device. This could allow a user to exploit a race condition and create memory corruption or possibly privilege escalation...

CVE-2017-14875

In the handler for the ioctl command VIDIOCMSMISPDUALHWLPMMODE in Android for MSM, Firefox OS for MSM, and QRD Android before 2017-05-23, a heap overread vulnerability exists...

CVE-2018-9004

In Advanced SystemCare Ultimate 11.0.1.58, the driver file Monitorx86.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c4060d0...

Input validation

In Advanced SystemCare Ultimate 11.0.1.58, the driver file Monitorx86.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x9c4060d0...

Joyent SmartOS SMB_IOC_SVCENUM IOCTL elevation of privilege vulnerability

Joyent SmartOS is a set of open source operating system from Joyent, USA. A security vulnerability exists in the SMBIOCTREERELE ioctl in Joyent SmartOS release-20170803-20170803T064301Z, which stems from the program failing to correctly detect user-submitted data, resulting in the size of copied...

CVE-2018-5701

In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x00226003...

Code injection

K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way...

Input validation

In K7 AntiVirus 15.1.0306, the driver file K7FWHlpr.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x8300212C...

TG Soft Vir.IT eXplorer Lite Denial of Service Vulnerability (CNVD-2017-37939)

TG Soft Vir.IT eXplorer Lite is a suite of virus protection software. The program features anti-virus, anti-spyware, malware and virus detection. A security vulnerability exists in the VIRAGTLT.SYS file in TG Soft Vir.IT eXplorer Lite version 8.5.65, which originates when the program fails to...

CPUID CPU-Z Arbitrary Read/Write Privilege Elevation Vulnerability

CPUID CPU-Z is a free software package for collecting information about system devices. A security vulnerability exists in versions of CPUID CPU-Z prior to 1.43, which originates from a program that can send ioctl 0x9C402430 calls to the kernel mode driver to exploit the vulnerability by writing ...

The vulnerability of the rzpnk.sys driver, a IOCTL handler for configuring a cloud-based system, allows a hacker to open a descriptor for arbitrary processes.

The vulnerability of the rzpnk.sys driver, a IOCTL handler for configuring a cloud-based system, is related to deficiencies in access control for the ZwOpenProcess procedure. Exploiting this vulnerability allows a malicious actor to open a descriptor for an arbitrary process remotely...

CVE-2017-9769

CVE-2017-9769 affects Razer Synapse, where a crafted IOCTL sent to the rzpnk.sys driver is forwarded to ZwOpenProcess, allowing opening a handle to an arbitrary process and enabling local privilege escalation. Public materials describe reading/writing memory and potential code execution via a hoo...

CVE-2017-9769

A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process. Recent assessments: zeroSteiner at November 21, 2019 11:14pm UTC reported: Analysis The Razer rzpnk.sys driver...

Oracle VM VirtualBox - Environment and ioctl Unprivileged Host User to Host Kernel Privilege Escalation

Oracle VM VirtualBox - Environment and ioctl Unprivileged Host User to Host Kernel Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1091 This bug report describes two separate issues that, when combined, allow any user on a Linux host system on which VirtualB...

The vulnerability of the Linux operating system, which allows a perpetrator to trigger a service failure or cause other effects

The vulnerability of the sgioctl function in the drivers/scsi/sg.c file of the Linux operating system is caused by buffer overflow on the stack. Exploiting this vulnerability can allow an attacker to trigger a service failure memory spillage or cause other effects by invoking the SGNEXTCMDLEN ioc...

The vulnerability of the Linux operating system’s kernel allows a hacker to trigger a service failure or cause other adverse effects.

The vulnerability of the sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c file, a audio driver for the MSM QDSP6 core of the Linux operating system, relates to the reading of data beyond the specified buffer. Exploiting this vulnerability can allow an attacker to cause service failures or other...

Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl

Quick EmulatorQEMU built with the Block driver for iSCSI images support virtio-blk is vulnerable to a heap-based buffer overflow issue. The flaw could occur while processing iSCSI asynchronous I/O ioctl2 calls. A user inside a guest could exploit this flaw to crash the QEMU process resulting in...

VulnCheck KEV: CVE-2014-4076

Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to 1 tcpip.sys or 2 tcpip6.sys, aka "TCP/IP Elevation of Privilege Vulnerability."...

DEBIAN-CVE-2016-2548

sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop action, which allows local users to cause a denial of service system crash via a crafted ioctl call, related to the 1 sndtimerclose and 2 sndtimerstop functions...