Executive Summary

The vulnerability exists in Safetica's endpoint client kernel driver ProcessMonitorDriver.sys in versions 10.5.75.0 and 11.11.4.0. It allows an unprivileged local user to exploit an insecure IOCTL (Input/Output Control) path to terminate protected system processes.

This flaw arises from improper input sanitization and user validation, enabling privilege escalation and denial-of-service attacks by terminating arbitrary system processes with elevated privileges.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can repeatedly terminate critical system processes, which can disrupt Safetica's security monitoring and potentially render systems unavailable.

This can lead to denial-of-service conditions and compromise the security posture of affected systems by disabling protection mechanisms.

• Disruption of security monitoring
• Denial-of-service attacks
• Potential privilege escalation

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious IOCTL requests targeting the ProcessMonitorDriver.sys kernel driver in Safetica's endpoint client. Since the flaw involves abuse of an insecure IOCTL path, observing unusual or unauthorized IOCTL calls can indicate exploitation attempts.

Deploying endpoint detection and response (EDR) tools is recommended to help identify and alert on such suspicious activities.

Specific commands are not provided in the available resources, but monitoring tools that track IOCTL calls or process termination events related to ProcessMonitorDriver.sys would be effective.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include monitoring for suspicious IOCTL requests and deploying endpoint detection and response tools to detect exploitation attempts.

Enforce policy-based restrictions such as Windows Group Policy or Application Control to block unauthorized access to the vulnerable ProcessMonitorDriver.sys driver.

As of the publication date, no vendor-provided fix is available, so these mitigations are critical to reduce risk.

Useful 0 Not Useful 0