Google reported that Microsoft failed to fix a Windows zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0880 | Local Privilege Escalation in Microsoft Windows splwow64.exe (CVE-2019-0880) CVE-2019-0880 is a local elevation of privilege (EoP) flaw in how splwow64.exe — the 64-bit Windows process used to let 32-bit applications print — handles certain calls. An attacker who can already execute low-privileged code on an affected system can trigger the flaw with no user interaction and gain elevated privileges, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 7.8, AV:L/PR:L/UI:N). The affected list covers most of the Windows fleet of the era: Windows 10 versions 1507 through 1903, Windows 8.1, Windows RT 8.1, and Windows Server 2012, 2016, and version 1903. Microsoft shipped the fix in the July 2019 security updates, which related coverage tied to two actively exploited Windows zero-days, and CISA formally added the flaw to its Known Exploited Vulnerabilities catalog on 2022-05-23, confirming in-the-wild exploitation (ransomware association unknown). EPSS currently rates the 30-day exploitation probability at 2.3% (82nd percentile), so unpatched systems remain a realistic target. Do: Apply the Microsoft security updates released in July 2019, or any later cumulative updates, to all affected Windows 10, Windows 8.1, Windows RT 8.1, and Windows Server systems, per the CISA KEV required action. Because exploitation requires local low-privileged code execution, prioritize shared and multi-user systems such as RDS/terminal servers, shared workstations, and kiosks. Verify remediation against the KEV entry added 2022-05-23; no public PoC is known, and no ransomware association has been established. | 7.8 | 2% | KEV |
| masshundreds of millions of Windows PCs and servers (Windows 10 alone had 800M+ active devices by 2019) | |
| CVE-2020-0986 | Windows Kernel Out-of-Bounds Write Enables Local Privilege Escalation (CVE-2020-0986) CVE-2020-0986 is an elevation of privilege vulnerability in the Microsoft Windows kernel caused by the kernel failing to properly handle objects in memory (classified as an out-of-bounds write, CWE-787). A local attacker who can already execute low-privileged code on a vulnerable machine can trigger the memory-corruption condition to elevate to SYSTEM/kernel-level privileges, gaining full read, write, and execution control over the system with no user interaction required. Affected deployments per the CPE data include Windows 8.1, Windows RT 8.1, Windows 10 versions 1507 through 2004, and Windows Server builds 1803 and 1903. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, while any association with ransomware remains unknown. EPSS rates a 15.9% probability of exploitation within 30 days (97th percentile), and Microsoft patched the flaw in its April 2020 monthly security updates alongside a batch of similar Windows kernel privilege escalation vulnerabilities. Do: Apply Microsoft security updates for every affected release without delay (the fix shipped in the April 2020 monthly security updates, and the CISA KEV required action is to update per vendor instructions); verify installed cumulative updates rather than relying on KB numbers alone. Because this is a local privilege escalation used for post-compromise elevation, prioritize endpoints and multi-user hosts (RDS/VDI, remote workers) where untrusted users or already-executed malware run locally. There is no reliable workaround for a kernel memory-handling flaw, so patching is the primary mitigation. | 7.8 | 16% | KEV |
| massorder of 10^8: plausibly hundreds of millions of Windows installations across the affected 2015-2020 builds |
Full article650 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 24, 2020
Google’s Project Zero experts publicly disclosed details of an improperly patched zero-day code execution vulnerability in Windows.
White hat hackers at Google’s Project Zero team has publicly disclosed details of an improperly patched zero-day vulnerability in Windows.
The vulnerability tracked as CVE-2020-0986, resides in the Print Spooler API and could be exploited by a threat actor to execute arbitrary code.
Google experts published the details of the vulnerability after Microsoft failed to address the issue within 90 days of responsible disclosure on September 24.
The flaw was reported to Microsoft by an anonymous user working with Trend Micro’s Zero Day Initiative (ZDI) in December 2019.
“The vulnerability is almost exactly the same as CVE-2019-0880 [detailed technical analysis]. Just like CVE-2019-0880, this vulnerability allows the attacker to call memcpy with arbitrary parameters in the splwow64 privileged address space. The arbitrary parameters are sent in an LPC message to splwow64.” reads the security advisory. “In this case, the vulnerable message type is 0x6D, which is the call to DocumentEvent. After DocumentEvent is called from GdiPrinterThunk, a call to memcpy can occur as long as you craft specific fields in your LPC message to the right values. This memcpy call is at gdi32full!GdiPrinterThunk+0x1E85A.”
Splwow64.exe is a Windows core system file that allows 32-bit applications to connect with the 64-bit printer spooler service on x64 Windows builds.
On May 19, 2010, ZDI published an advisory after that threat actors exploited the flaw in the wild in a campaign tracked as “Operation PowerFall.”
In May 2020, Kaspersky experts spotted an attack on a South Korean company, threat actors chained two zero-day exploits: a remote code execution exploit for Internet Explorer and an elevation of privilege exploit for Windows.
“This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.” reads the ZDI’s advisory.
“The specific flaw exists within the user-mode printer driver host process splwow64.exe. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to escalate privileges from low integrity and execute code in the context of the current user at medium integrity.”
In May, Kaspersky (@oct0xor) discovered CVE-2020-0986 in Windows splwow64 was exploited itw as a 0day. Microsoft released a patch in June, but that patch didnt fix the vuln. After reporting that bad fix in Sept under a 90day deadline, it's still not fixed. https://t.co/WDGNs3JGka
— Maddie Stone (@maddiestone) December 23, 2020
An attacker could exploit this zero-day to manipulate the memory of the “splwow64.exe” process to achieve execution of arbitrary code in kernel mode. The flaw could allow installing malicious programs, view, change, or delete data, and create new accounts with full user rights.
Microsoft attempted to address the issue with the June Patch Tuesday security updates, but Google Project Zero experts discovered that the issue has not been fully solved.
The original issue was an arbitrary pointer dereference which allowed the attacker to control the src and dest pointers to a memcpy. The "fix" simply changed the pointers to offsets, which still allows control of the args to the memcpy.
— Maddie Stone (@maddiestone) December 23, 2020
“CVE-2020-0986, which was exploited in the wild[1] was not fixed. The vulnerability still exists, just the exploitation method had to change.” reads the advisory published by Google Project Zero researcher Maddie Stone.
The issue received a new CVE, CVE-2020-17008, and will be likely fixed by Microsoft in January.
Google experts have also shared a proof-of-concept (PoC) exploit code for CVE-2020-17008.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Windows)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/112578/hacking/google-windows-zero-day-flaw.html