CVE-2010-5177

CVE-2010-5177 describes a race condition in Sophos Endpoint Security and Control 9.0.5 on Windows XP. This vulnerability allows local users to bypass kernel-mode hook handlers, enabling the execution of dangerous code that would typically be blocked. The attack involves manipulating user-space memory during hook-handler execution, known as an argument-switch or KHOBE attack. The vulnerability has a CVSS score of 6.2, indicating a moderate to high severity. It requires local access and high attack complexity (AV:L/AC:H), but if successful, it can lead to complete compromise of confidentiality, integrity, and availability (C:C/I:C/A:C). The vendor disputes this as a flaw in a protection mechanism rather than a direct vulnerability. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with the majority of CVEs.