Security Experts Release Exploit for Patched Windows Flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-29336 | Use-after-free privilege escalation to SYSTEM in Microsoft Win32k CVE-2023-29336 is a use-after-free flaw (CWE-416) in Microsoft's Win32k kernel component that allows privilege escalation to SYSTEM. It is triggered by code running on a Windows host that causes the Win32k driver to reference freed kernel memory; the exact trigger path is not detailed in the available data, but as a kernel elevation-of-privilege issue it requires local code execution or an attacker already holding a foothold on the machine. A successful exploit grants SYSTEM privileges, giving the attacker full control of the compromised host. Because Win32k ships in every supported Windows client and server, effectively the entire Windows installed base is exposed to the flaw. The vulnerability is confirmed exploited in the wild — CISA added it to the KEV catalog on 2023-05-09 — and EPSS places its 30-day exploitation probability at 40.9% (99th percentile), though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Apply Microsoft's current cumulative Windows security updates (issued May 2023, per the CISA KEV required action) across all Windows clients and servers, prioritizing servers and systems exposed to untrusted users since the flaw is being actively exploited. Until patched, limit untrusted local code execution and restrict remote entry points such as RDP, because local privilege escalation flaws are commonly chained into full compromises. Verify update installation after deployment; specific affected build numbers and any ransomware involvement are not stated in the available data. | 7.8 | 41% | KEV PoC |
| mass≈1 billion+ Windows devices (Win32k ships in every supported Windows client and server) |
Full article312 words · extracted from infosecurity-magazine.com · click to collapse
Security researchers have discovered and released details about an actively exploited Microsoft Windows security flaw that could allow threat actors to gain elevated privileges on affected systems.
Tracked as CVE-2023-29336 and rated 7.8 in CVSS severity, the vulnerability is related to an elevation of privilege bug in the Win32k component of Windows. A patch for the flaw was released by Microsoft as part of the May 2023 Patch Tuesday update.
Read more on the latest Patch Tuesday: Microsoft Patches Three Zero-Day Bugs This Month
Although the exact details of the in-the-wild exploitation remain unknown, cybersecurity firm Numen Cyber has deconstructed the patch released by Microsoft and created a proof-of-concept (PoC) exploit for Windows Server 2016.
In its advisory, Numen Cyber highlighted that Win32k vulnerabilities have a history. Microsoft has attempted to refactor this part of the kernel code using Rust in the latest Windows 11 preview version, which may eliminate such vulnerabilities in the future.
The vulnerability allows low-privileged users to obtain SYSTEM privileges, the highest user mode privileges in Windows. Cybersecurity firm Avast was first credited with discovering the flaw, revealing that it was actively exploited as a zero-day in attacks.
Fast forward to this week, Numen Cyber warned that exploiting this vulnerability does not require novel techniques and heavily relies on leaked desktop heap handle addresses. Therefore, older systems remain at risk if this issue is not addressed thoroughly.
“While this vulnerability seems to be non-exploitable on the Win11 system version, it poses a significant risk to earlier systems,” reads the technical write-up.
System administrators are advised to be vigilant for abnormal offset reads and writes in memory or related to window objects, as they may indicate active exploitation of CVE-2023-29336 for local privilege escalation.
Additional vulnerabilities potentially allowing attackers to gain elevated privileges were recently discovered in the popular graphics debugger RenderDoc.
Image credit: diy13 / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/experts-release-exploit-windows/