Details have emerged about a now-patched actively exploited security flaw in Microsoft Windows that could be abused by a threat actor to gain elevated privileges on affected systems.
The vulnerability, tracked as CVE-2023-29336, is rated 7.8 for severity and concerns an elevation of privilege bug in the Win32k component.
“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” Microsoft disclosed in an advisory issued last month as part of Patch Tuesday updates.
Avast researchers Jan Vojtěšek, Milánek, and Luigino Camastra were credited with discovering and reporting the flaw.https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7983783048239650&output=html&h=280&slotname=2185767680&adk=3733870062&adf=4257282429&pi=t.ma~as.2185767680&w=336&fwrn=4&fwrnh=100&lmt=1686326086&rafmt=12&format=336×280&url=https%3A%2F%2Fthehackernews.com%2F2023%2F06%2Fexperts-unveil-poc-exploit-for-recent.html&fwr=0&fwrattr=true&rh=280&rw=336&sfro=1&wgl=1&dt=1686343379416&bpp=1&bdt=279&idt=474&shv=r20230607&mjsv=m202306060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5604485fd265ab7d-220e8a6d58df0019%3AT%3D1682023517%3ART%3D1686343375%3AS%3DALNI_MZRZpKGtl2P_PjUncQNpTaITwMVHw&gpic=UID%3D00000bfafde4201f%3AT%3D1682023517%3ART%3D1686343375%3AS%3DALNI_MZ7r6MeYnHbeN-7VL4OzLpQ1EVkYw&prev_fmts=0x0&nras=1&correlator=4176231527538&frm=20&pv=1&ga_vid=749797007.1686343380&ga_sid=1686343380&ga_hid=1408209083&ga_fc=0&u_tz=330&u_his=1&u_h=900&u_w=1440&u_ah=809&u_aw=1440&u_cd=24&u_sd=2&adx=218&ady=1321&biw=771&bih=729&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44788442%2C44793498%2C44794402&oid=2&pvsid=3563430159820945&tmod=640565317&uas=0&nvt=1&fc=1920&brdim=654%2C25%2C654%2C25%2C1440%2C25%2C786%2C809%2C786%2C729&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=VvnaC27NLY&p=https%3A//thehackernews.com&dtd=597
Win32k.sys is a kernel-mode driver and an integral part of the Windows architecture, being responsible for graphical device interface (GUI) and window management.
While the exact specifics surrounding in-the-wild abuse of the flaw is presently not known, Numen Cyber has deconstructed the patch released by Microsoft to craft a proof-of-concept (PoC) exploit for Windows Server 2016.
The Singapore-based cybersecurity company said the vulnerability relied on the leaked kernel handle address in the heap memory to ultimately obtain a read-write primitive.
“Win32k vulnerabilities are well-known in history,” Numen Cyber said. “However, in the latest Windows 11 preview version, Microsoft has attempted to refactor this part of the kernel code using Rust. This may eliminate such vulnerabilities in the new system in the future.”
Numen Cyber distinguishes itself from typical Web3 security companies by emphasizing the need for advanced security capabilities, specifically focusing on OS-level security attack and defense capabilities. Their products and services offer state-of-the-art solutions to address the unique security challenges of Web3.