The fourth horseman: CVE-2019-0797 vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-8589 | Local Privilege Escalation in Microsoft Windows Win32k (Windows 7 / Server 2008) CVE-2018-8589 is an elevation of privilege vulnerability in Win32k.sys, the Windows kernel-mode component that handles system calls, affecting Windows 7, Windows Server 2008, and Windows Server 2008 R2. It is triggered when Windows improperly handles calls to Win32k.sys, allowing a local attacker who is already able to execute low-privileged code (for example, via a malicious application or as a second stage of a browser exploit) to escalate privileges. A successful exploit grants the attacker elevated (kernel/SYSTEM-level) privileges on the local machine, typically enabling full control and often chained with code-execution bugs. Windows 7 and Windows Server 2008/2008 R2 users and administrators are affected; the flaw was patched in Microsoft's November 2018 security updates. The vulnerability was known to be actively exploited in the wild at the time of the November 2018 Patch Tuesday, and it is listed in CISA's Known Exploited Vulnerabilities catalog (added May 23, 2022), with EPSS at roughly 3% (87th percentile). Do: Apply the Microsoft November 2018 security updates (or later) to all Windows 7, Windows Server 2008, and Windows Server 2008 R2 systems, per the CISA KEV required action. Because Windows 7 and Server 2008 are past end of support, verify patch status on legacy/extended-support (ESU) systems, inventory any remaining unpatched hosts, and prioritize upgrading them; until patched, limit execution of untrusted local code and keep kernel exploit mitigations enabled. | 7.8 | 3% | KEV |
| masshundreds of millions of Windows 7 devices worldwide at disclosure, plus widespread Windows Server 2008/2008 R2 deployments | |
| CVE-2018-8611 | Local Privilege Escalation in Microsoft Windows Kernel Exploited in the Wild CVE-2018-8611 is an elevation-of-privilege vulnerability in the Microsoft Windows kernel caused by improper handling of objects in memory (recorded as CWE-404, improper resource shutdown/release). It is a local flaw: an attacker who can already run code with limited privileges on a target machine can trigger it with a specially crafted application, with no user interaction required. Successful exploitation executes code in kernel context, elevating the attacker to SYSTEM/administrator and giving full control of the host, a typical post-initial-access step in ransomware chains. Nearly every Windows client and server version in support at disclosure is affected: Windows 7, 8.1, RT 8.1 and Windows 10 (1607 through 1809), plus Windows Server 2008 through 2019. The flaw is confirmed exploited in the wild, with CISA adding it to the KEV catalog on 2022-05-24 and an EPSS of 4.2% (90th percentile); the KEV record lists ransomware use as unknown, though public reporting ties a family of Windows kernel EoP exploits including this one to ransomware operators. Do: Apply Microsoft's December 2018 security update for CVE-2018-8611 on all affected Windows 7, 8.1, RT 8.1, 10 and Server 2008-2019 hosts; there is no known workaround and patching is the required CISA KEV action, so verify the December 2018 (or later) monthly rollup is installed. Prioritize servers and workstations where limited-privilege users or untrusted workloads run (RDS, application servers, shared endpoints), and treat any remaining unpatched Windows 7/8.1/legacy-Server machine as high risk because ransomware operators have been observed chaining Windows kernel EoP exploits like this one after initial access. | 7.8 | 4% | KEV |
| masshundreds of millions of Windows endpoints at time of disclosure (~700M active Windows 10 devices plus hundreds of millions of Windows 7 PCs), with residual… | |
| CVE-2019-0797 | Win32k Elevation of Privilege in Microsoft Windows (Exploited as Zero-Day) CVE-2019-0797 is an elevation of privilege flaw in the Windows Win32k kernel component, which fails to properly handle objects in memory. A local attacker who can already execute code on an affected machine can trigger the bug with a specially crafted application and escalate from a low-privileged user account to SYSTEM-level privileges, gaining full control of the host; this flaw is distinct from the related CVE-2019-0808 fixed the same month. Any system running an affected Windows release is exposed: Windows 10 versions 1507 through 1809, Windows 8.1 and RT 8.1, and Windows Server 2012, 2016, 1709 and 1803. The bug was a zero-day when Microsoft patched it in March 2019, having been used in targeted attacks attributed to the FruityArmor and SandCat groups, and it is listed in CISA's Known Exploited Vulnerabilities catalog, so in-the-wild exploitation is confirmed even though no public proof-of-concept is known. Do: Apply Microsoft's March 2019 cumulative updates (or monthly rollups for Windows 8.1/RT 8.1 and Server 2012) on every affected Windows 10, 8.1, and Server build, and confirm installation by checking the OS build/update level via winver or systeminfo. Because the flaw was used as a zero-day by FruityArmor and SandCat in targeted attacks, review endpoint telemetry for signs of those campaigns and treat the CISA KEV patching requirement as binding. Prioritize systems where low-privileged users run untrusted code, since exploitation requires only local code execution and then yields full SYSTEM-level control. | 7.8 | 2% | KEV |
| mass≈hundreds of millions of Windows devices (affected versions spanned nearly the entire Windows 10 installed base of roughly 800M devices, plus Windows 8.1/RT… |
Full article540 words · extracted from securelist.com · click to collapse
In February 2019, our Automatic Exploit Prevention (AEP) systems detected an attempt to exploit a vulnerability in the Microsoft Windows operating system. Further analysis of this event led to us discovering a zero-day vulnerability in win32k.sys. We reported it to Microsoft on February 22, 2019. The company confirmed the vulnerability and assigned it CVE-2019-0797. Microsoft have just released a patch, crediting Kaspersky Lab researchers Vasiliy Berdnikov and Boris Larin with the discovery:
This is the fourth consecutive exploited Local Privilege Escalation vulnerability in Windows we have discovered recently using our technologies. Just like with CVE-2018-8589, we believe this exploit is used by several threat actors including, but possibly not limited to, FruityArmor and SandCat. While FruityArmor is known to have used zero-days before, SandCat is a new APT we discovered only recently. In addition to CVE-2019-0797 and CHAINSHOT, SandCat also uses the FinFisher/FinSpy framework.
Kaspersky Lab products detected this exploit proactively through the following technologies:
- Behavioral detection engine and Automatic Exploit Prevention for endpoint products;
- Advanced Sandboxing and Anti Malware engine for Kaspersky Anti Targeted Attack Platform (KATA).
Kaspersky Lab verdicts for the artifacts used in this and related attacks are:
- HEUR:Exploit.Win32.Generic
- HEUR:Trojan.Win32.Generic
- PDM:Exploit.Win32.Generic
Brief technical details – CVE-2019-0797
CVE-2019-0797 is a race condition that is present in the win32k driver due to a lack of proper synchronization between undocumented syscalls NtDCompositionDiscardFrame and NtDCompositionDestroyConnection. The vulnerable code can be observed below on screenshots made on an up-to-date system during initial analysis:
Snippet of NtDCompositionDiscardFrame syscall (Windows 8.1)
On this screenshot with the simplified logic of the NtDCompositionDiscardFrame syscall you can see that this code acquires a lock that is related to frame operations in the structure DirectComposition::CConnection and tries to find a frame that corresponds to a given id and will eventually call a free on it. The problem with this can be observed on the second screenshot:
Snippet of NtDCompositionDestroyConnection syscall inner function (Windows 8.1)
On this screenshot with the simplified logic of the function DiscardAllCompositionFrames that is called from within the NtDCompositionDestroyConnection syscall you can see that it does not acquire the necessary lock and calls the function DiscardAllCompositionFrames that will release all allocated frames. The problem lies in the fact that when the syscalls NtDCompositionDiscardFrame and NtDCompositionDestroyConnection are executed simultaneously, the function DiscardAllCompositionFrames may be executed at a time when the NtDCompositionDiscardFrame syscall is already looking for a frame to release or has already found it. This condition leads to a use-after-free scenario.
Interestingly, this is the third race condition zero-day exploit used by the same group in addition to CVE-2018-8589 and CVE-2018-8611.
Stop execution if module file name contains substring “chrome.exe”
The exploit that was found in the wild was targeting 64-bit operating systems in the range from Windows 8 to Windows 10 build 15063. The exploitation process for all those operating systems does not differ greatly and is performed using heap spraying palettes and accelerator tables with the use of GdiSharedHandleTable and gSharedInfo to leak their kernel addresses. In exploitation of Windows 10 build 14393 and higher windows are used instead of palettes. Besides that, that exploit performs a check on whether it’s running from Google Chrome and stops execution if it is because vulnerability CVE-2019-0797 can’t be exploited within a sandbox.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/