Description
Comodo Internet Security’s firewall driver Inspect.sys contains an integer underflow in its IPv6 packet parser. The parser decrements an unsigned 64-bit payload-length value (taken from the IPv6 fixed header’s payload length field) by the size of each IPv6 extension header without validating it, so a packet whose declared payload length is smaller than the sum of its extension-header lengths underflows the value to a near-maximal 64-bit integer. Because IPv6 parsing occurs before firewall rule enforcement, a remote, unauthenticated attacker can send a single crafted IPv6 packet – even to a host with all ports blocked – to trigger an out-of-bounds read (and, on a separate code path, an oversized memcpy) in the Windows kernel at DISPATCH_LEVEL, crashing the system (BSOD).
Problem types
Integer Underflow (Wrap or Wraparound)
Product status
Any version
Credits
Marcus Hutchins (MalwareTech)
References
malwaretech.com/…rability-in-comodo-internet-security.html (MalwareTech – ComoDoS)
github.com/MalwareTech/ComoDoS (Proof of Concept)
www.vulncheck.com/…eger-underflow-remote-denial-of-service (VulnCheck Advisory: Comodo Internet Security Inspect.sys IPv6 Integer Underflow Remote Denial of Service)
