CyberRota Analysis
AI-GeneratedThe Endpoint DLP component of the Netskope Client for Windows prior to version R141 is vulnerable due to improper token validation and uninitialized reply buffers, allowing local unprivileged processes to send unauthorized queries and leak sensitive kernel memory. This could enable attackers to enumerate DLP configurations, extract live session tokens, and access fragments of other users' kernel memory. Organizations using affected versions of the Netskope Client should prioritize patching to mitigate potential information leakage risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.