CVE-2021-43002

Vulnerability

A buffer overflow vulnerability exists in the IOCTL handler 0x22001B of Amzetta zPortal DVM Tools versions up to and including v3.3.148.148. The vulnerability occurs when processing specially crafted I/O Request Packets (IRPs) sent to the driver, leading to memory corruption. [1]

Exploitation

An attacker must have local access to the system and the ability to send IOCTL requests to the vulnerable driver. No authentication is required beyond local user access. By sending a crafted IRP with an oversized input buffer, the attacker can trigger a buffer overflow that corrupts kernel memory. [1]

Impact

Successful exploitation allows an attacker to execute arbitrary code in kernel mode, gaining the highest level of privileges on the system. This can lead to full system compromise, including disabling security products, overwriting system components, or causing an OS crash (denial of service). [1]

Mitigation

The vendor, Amzetta, has released a security update to address this vulnerability. Users should upgrade to a version later than v3.3.148.148. The update may be automatically applied or require manual action depending on the deployment. [1]