CVE-2015-8772
📋 TL;DR
This vulnerability in McAfee File Lock driver allows local users to read sensitive kernel memory or crash the system by sending a specially crafted IOCTL request. It affects systems running McAfee Total Protection with File Lock 5.x. Attackers need local access to exploit this flaw.
💻 Affected Systems
- McAfee Total Protection
- McAfee File Lock
📦 What is this software?
File Lock by Mcafee
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash (BSOD) or exposure of sensitive kernel memory contents including passwords, encryption keys, and other privileged data.
Likely Case
System instability leading to crashes or information disclosure from kernel memory.
If Mitigated
Limited impact if proper access controls prevent unauthorized local users from executing code.
🎯 Exploit Status
Exploit requires local user access and knowledge of driver interaction. Proof of concept code has been publicly disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to McAfee Total Protection with fixed driver version
Vendor Advisory: https://kc.mcafee.com/corporate/index?page=content&id=SB10156
Restart Required: Yes
Instructions:
1. Open McAfee SecurityCenter 2. Click 'Update' 3. Apply all available updates 4. Restart the system 5. Verify McPvDrv.sys version is updated
🔧 Temporary Workarounds
Disable McAfee File Lock
windowsTemporarily disable the vulnerable File Lock component
Open McAfee SecurityCenter
Navigate to 'Real-Time Scanning'
Disable 'File Lock' feature
Restrict driver access
windowsUse Windows security policies to restrict access to the vulnerable driver
Use Group Policy or local security policy to restrict non-admin access to driver operations
🧯 If You Can't Patch
- Implement strict local user access controls to prevent unauthorized code execution
- Monitor for suspicious driver interaction attempts and system crashes
🔍 How to Verify
Check if Vulnerable:
Check McPvDrv.sys driver version in C:\Windows\System32\drivers\ or using 'driverquery' commandCheck Version:
driverquery | findstr McPvDrvVerify Fix Applied:
Verify McPvDrv.sys version is newer than 4.6.111.0 and no longer exhibits the vulnerability📡 Detection & Monitoring
Log Indicators:
- System crashes (Event ID 41)
- Driver access failures
- Unexpected IOCTL requests to McPvDrv.sys
Network Indicators:
- None - local exploit only
SIEM Query:
EventID=41 AND Source='Microsoft-Windows-Kernel-Power' OR ProcessName contains 'exploit' AND TargetObject contains 'McPvDrv'