CVE-2019-15665
📋 TL;DR
This vulnerability in Rivet Killer Control Center allows local attackers to execute arbitrary code or escalate privileges by exploiting an unvalidated offset parameter in a kernel driver IOCTL handler. It affects users running vulnerable versions of the software on Windows systems. Successful exploitation gives attackers kernel-level access to the system.
💻 Affected Systems
- Rivet Killer Control Center
- Killer Networking software
📦 What is this software?
Killer Control Center by Killernetworking
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with kernel-level code execution leading to complete control of the affected system, data theft, and lateral movement capabilities.
Likely Case
Local privilege escalation allowing a standard user to gain SYSTEM/administrator privileges on the compromised machine.
If Mitigated
Limited to denial of service or system instability if proper security controls prevent code execution.
🎯 Exploit Status
Exploitation requires local access and knowledge of driver interaction. FireEye published technical details including IOCTL information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.1352 and later
Vendor Advisory: https://support.killernetworking.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf
Restart Required: Yes
Instructions:
1. Download Killer Control Center version 2.1.1352 or later from official Killer Networking website. 2. Uninstall previous version. 3. Install updated version. 4. Restart system to load patched driver.
🔧 Temporary Workarounds
Disable or remove vulnerable driver
windowsUninstall Killer Control Center or disable the KfeCo10X64.sys driver to prevent exploitation.
sc stop KfeCo10X64
sc delete KfeCo10X64
Restrict driver access
windowsApply ACL restrictions to prevent non-administrative users from accessing the vulnerable driver.
icacls "C:\Windows\System32\drivers\KfeCo10X64.sys" /deny Users:(R,X)
🧯 If You Can't Patch
- Implement strict least privilege principles to limit standard user capabilities
- Monitor for suspicious driver interactions and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if KfeCo10X64.sys driver version is older than 2.1.1352. Look for driver file in System32\drivers and check properties.Check Version:
wmic product where "name like '%Killer%'" get versionVerify Fix Applied:
Verify Killer Control Center version is 2.1.1352 or newer in Programs and Features, and confirm driver version in device manager.📡 Detection & Monitoring
Log Indicators:
- Driver load events for KfeCo10X64.sys
- Process creation with elevated privileges following driver interaction
- System event logs showing driver crashes or unexpected behavior
Network Indicators:
- No network indicators - this is a local exploit
SIEM Query:
EventID=7045 AND ServiceName="KfeCo10X64" OR ProcessName="KillerControlCenter.exe" AND ParentProcess="explorer.exe"🔗 References
- https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0009/FEYE-2019-0009.md
- https://support.killernetworking.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf
- https://www.killernetworking.com
- https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0009/FEYE-2019-0009.md
- https://support.killernetworking.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf
- https://www.killernetworking.com
