0patch released micropatch for BearLPE flaw in Win 10 Task Scheduler

Researchers at 0patch released a temporary micropatch for the unpatched BearLPE local privilege escalation zero-day flaw in Windows 10.

Experts at 0patch released a micropatch to temporary fix a still-unpatched local privilege escalation on systems without rebooting them.

The zero-day vulnerability, dubbed BearLPE, was recently disclosed by the security researcher SandboxEscaper. 

The following video shows how the micropatch, composed of just five instructions, works on a vulnerable machine:

The exploit published by the expert triggers the flaw that resides in the Task Scheduler of Windows 10.

SandboxEscaper discovered that even starting with limited privileges it is possible to get SYSTEM rights by invoking a specific function. SandboxEscaper published a video PoC of the Windows zero-day that shows how to trigger it on Windows x86.

Will Dormann, vulnerability analyst at CERT/CC, confirmed that the Windows zero-day works on a fully patched (May 2019) Windows 10 x86 system.

According to Will Dormann, a vulnerability analyst at CERT/CC, the exploit is 100% reliable on x86 systems and needs to be recompiled for x64 machines.

I can confirm that this works as-is on a fully patched (May 2019) Windows 10 x86 system. A file that is formerly under full control by only SYSTEM and TrustedInstaller is now under full control by a limited Windows user.
Works quickly, and 100% of the time in my testing. pic.twitter.com/5C73UzRqQk

— Will Dormann (@wdormann) May 21, 2019

“When you run Windows XP schtasks.exe on Windows 10, legacy RPC functions are called – which in turn call the current ones, such as SchRpcSetSecurity,” explained 0patch co-founder Mitja Kolsek.ù

The micropatch prevents changing the set of permissions a normal user has over a system file.

If you appreciate my effort in spreading cybersecurity awareness, please vote for Security Affairs in the section “Your Vote for the Best EU Security Tweeter”

Thank you

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – micropatch, BearLPE)

[adrotate banner=”5″]

[adrotate banner=”13″]

---

---