Vulnerability Spotlight: Use-after-free vulnerability in Windows 10 win32kbase
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-0731 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privile An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0691, CVE-2020-0719, CVE-2020-0720, CVE-2020-0721, CVE-2020-0722, CVE-2020-0723, CVE-2020-0724, CVE-2020-0725, CVE-2020-0726. NVD description · AI analysis pending | 7.8 | 1% |
| — |
Full article240 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, February 11, 2020 14:31
Marcin Towalski of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
Cisco Talos is releasing the details of a use-after-free vulnerability in Windows 10. An attacker could exploit this vulnerability to gain the ability to execute arbitrary code in the kernel context. Microsoft
disclosed this vulnerability in this month’s Patch Tuesday. For more on the updates Microsoft released, read Talos’ full blog here.
In accordance with our coordinated disclosure policy, Cisco Talos worked with Microsoft to ensure that these issues are resolved and that an update is available for affected customers.
Vulnerability details Windows 10 win32kbase HMMarkObjectDestroy arbitrary code execution vulnerability (TALOS-2019-0970/CVE-2020-0731)
A use after free vulnerability exists in Windows 10, Version 10.0.19033.1, when a Win32k component fails to properly handle objects in memory. Successful exploitation of this vulnerability can lead to arbitrary code execution in the kernel context and elevation of privileges. This vulnerability occurs only on an x86 machine.
Read the complete vulnerability advisory here for additional information.
Versions tested Talos tested and confirmed that this vulnerability affects Microsoft Windows 10, version 10.0.19033.1, Insider Preview Fast running on an x86 machine.
Coverage The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.
Snort Rules: 52432, 52433
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/vuln-spotlight-windows-10-use-after-free-feb-2020/