Full Report
Arbitrary memory read from controlled memory pointer in Gemalto’s HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 leads to remote denial of service.
Analysis Summary
# Vulnerability: Sentinel LDK RTE Arbitrary Memory Read DoS
## CVE Details
- **CVE ID:** CVE-2017-12820
- **CVSS Score:** 7.5 (High) - *Note: The provided text lists the vector string [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H] which calculates to 7.5, despite the "0.0" typo in the source text.*
- **CWE:** CWE-125 (Out-of-bounds Read) / Arbitrary memory read from controlled pointer.
## Affected Systems
- **Products:** Gemalto (Thales) HASP SRM, Sentinel HASP, and Sentinel LDK.
- **Versions:** All versions prior to Sentinel LDK RTE (Run-time Environment) version 7.55 / 7.60.
- **Configurations:** Systems running the Sentinel License Manager service, typically listening on network ports.
## Vulnerability Description
The vulnerability exists within the Sentinel LDK Run-time Environment due to improper validation of a memory pointer. An attacker can provide a specially crafted input that contains a controlled memory pointer. When the application attempts to read from this arbitrary memory location, it leads to an invalid memory access (segmentation fault or access violation), resulting in a crash of the service.
## Exploitation
- **Status:** Unknown (No public PoC cited in advisory, but theoretically straightforward).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (Remote Denial of Service)
## Remediation
### Patches
- **Sentinel LDK RTE v7.60 or higher:** Users are advised to upgrade the Run-time Environment to the latest version to resolve the flaw.
### Workarounds
- No specific software workarounds were provided by the vendor; upgrading the RTE is the primary remediation.
## Detection
- **Network Monitoring:** Monitor traffic for suspicious behavior or malformed packets targeting remote port **1947** (the default port for Sentinel License Manager).
- **Endpoint Monitoring:** Monitor for unexpected crashes of the Sentinel License Manager service and review system event logs for access violations related to HASP/Sentinel processes.
- **File Execution:** Monitor for suspicious file executions associated with the license manager environment.
## References
- **Vendor Advisory:** hxxps[://]sentinelcustomer[.]gemalto[.]com/sentineldownloads/
- **NVD CVE Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2017-12820
- **Kaspersky ICS CERT:** hxxps[://]ics-cert[.]kaspersky[.]com/advisories/2017/10/02/klcert-17-006-sentinel-ldk-rte-arbitrary-memory-read-from-controlled-memory-pointer-leads-to-remote-denial-of-service/