CVE-2009-0080 in Windows
Summary
by MITRE
The ThreadPool class in Windows Vista Gold and SP1, and Server 2008, does not properly implement isolation among a set of distinct processes that (1) all run under the NetworkService account or (2) all run under the LocalService account, which allows local users to gain privileges by leveraging incorrect thread ACLs to access the resources of one of the processes, aka "Windows Thread Pool ACL Weakness Vulnerability."
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 06/01/2025
The vulnerability identified as CVE-2009-0080 represents a critical security flaw in the Windows thread pool implementation affecting Windows Vista Gold and SP1, as well as Windows Server 2008 systems. This weakness manifests in the improper handling of access control lists within the ThreadPool class, specifically when multiple processes operate under the NetworkService or LocalService accounts. The fundamental issue lies in the inadequate isolation mechanisms that should prevent processes running under these service accounts from accessing each other's resources, creating a potential privilege escalation vector for local attackers.
The technical implementation flaw stems from how the Windows thread pool manages security contexts for processes executing under restricted service accounts. When multiple processes share the same service account credentials, the ThreadPool class fails to establish proper access control boundaries that would normally prevent cross-process resource access. This misimplementation allows a malicious local user to exploit incorrect thread ACLs to gain unauthorized access to resources belonging to other processes running under the same service account. The vulnerability specifically targets the security model's assumption that processes running under identical service accounts should remain isolated from each other's operational contexts.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables attackers to potentially access sensitive data, manipulate system resources, or execute unauthorized operations within the compromised processes. The attack surface is particularly concerning because NetworkService and LocalService accounts are commonly used for running system services and applications, making the exploitation potential widespread across various system components. This weakness undermines the principle of least privilege that should normally protect system integrity when multiple processes operate under similar security contexts.
Security researchers have classified this vulnerability under CWE-284, which addresses improper access control mechanisms in software implementations. The vulnerability aligns with ATT&CK technique T1068, which involves exploiting local privilege escalation opportunities through improper access control. Microsoft's official patch addresses the issue by correcting the thread pool's access control list implementation to properly isolate processes running under the same service account credentials. Organizations should implement the security update immediately and conduct thorough security assessments to identify any potential exploitation attempts, while also reviewing service account usage patterns to minimize the attack surface for similar vulnerabilities. The incident highlights the critical importance of proper access control implementation in system-level components and demonstrates how seemingly minor flaws in security architecture can create significant operational risks for enterprise environments.