This vulnerability in Netskope Endpoint DLP's kernel driver (epdlpdrv.sys) involves two main issues: first, the internal communication channel used by the user-space hook DLL to communicate with the kernel driver lacks proper token-based message validation, allowing unauthorized local processes to send queries. Second, the reply buffer in the port message handler is not properly initialized before returning data, causing leakage of residual kernel pool memory. Exploitation by a local unprivileged attacker could lead to enumeration of DLP configuration and feature flags, extraction of live session tokens, and reading of kernel memory fragments from other users' operations.

An attacker with local unprivileged access can exploit this vulnerability to gain unauthorized visibility into sensitive information such as DLP configuration settings, feature flags, live session tokens, and kernel memory fragments. This information leakage could aid further attacks or unauthorized data access within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to R141, upgrading to version R141 or later is implied as a remediation step once official guidance is available. Until then, restrict local unprivileged access to trusted users and monitor for suspicious local activity.