CVE-2020-8607

Vulnerability

A vulnerability exists in the Trend Micro anti-rootkit driver, which is used in multiple Trend Micro products. The driver improperly validates user-supplied input (CWE-1285), allowing a user-mode process with administrator privileges to pass a crafted IOCTL or other request that modifies a kernel memory address. Affected versions include any product using a vulnerable version of this driver; the specific product list is provided by Trend Micro [1][2].

Exploitation

To exploit this vulnerability, an attacker must already have obtained administrator-level access on the target system (either legitimately or via another attack). With that privilege, the attacker can send a specially crafted IOCTL or other driver interaction to abuse the input validation flaw. No user interaction beyond obtaining initial admin access is required. The attack is performed locally (CVSS:AV:L) and has low complexity [2].

Impact

Successful exploitation can lead to a system crash (denial of service) or arbitrary code execution in kernel mode. This gives the attacker full control over the system, including the ability to read, modify, or destroy data, install persistent malware, and escalate privileges beyond the initial admin level. The CVSS score is 7.8 (High) with confidentiality, integrity, and availability all rated as high [1][2].

Mitigation

Trend Micro has released updates and patches for vulnerable products. Users should update to the latest version or apply the appropriate patch as indicated by the vendor. As a workaround, administrators should not assign administrative privileges to untrusted users. No workaround that directly fixes the driver flaw is available. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing [1][2].