Tried, Tested and Proven

Vulnerability title: Null Pointer Dereference in K7 Computing Multiple Products [K7Sentry.sys]

CVE: CVE-2014-8608
Vendor: K7 Computing
Product: Multiple Products [K7Sentry.sys]
Affected version:
Fixed version:
Reported by: Kyriakos Economou


Latest and possibly earlier versions of K7Sentry.sys kernel mode driver, also named as ‘K7AV Sentry Device Driver’, allows any local user to crash the system by creating a file that contains the string “crashme$$” in its name. Once the file is created, any attempt to access it will result into a null pointer dereference leading to a system crash through a BSoD.

b9d087ce ff156059dab9 call dword ptr [K7Sentry+0xa9960 (b9da5960)] ds:0023:b9da5960={nt!wcsstr (80537ff5)} - search for "crashme$$" in the filename
b9d087d4 83c408 add esp,8
b9d087d7 85c0 test eax,eax
b9d087d9 7406 je K7Sentry+0xc7e1 (b9d087e1)
b9d087db 893500000000 mov dword ptr ds:[0],esi - if found write esi to [0] leading to system crash


This vulnerability allows a local attacker to cause a denial of service condition.


The proof of concept exploit is available.


Update the K7Sentry.sys driver to the latest version.

Vendor status:

22/09/2014 Advisory created
22/09/2014 Vendor contacted
24/09/2014 Vendor working on a fix
11/11/2014 Fix released
19/11/2014 CVE obtained
19/11/2014 Published

Copyright © Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.


The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.