Microsoft Windows up to Server 2019 Kernel access control

Summaryinfo

A vulnerability, which was classified as critical, has been found in Microsoft Windows. This vulnerability affects unknown code of the component Kernel. Performing a manipulation results in access control. This vulnerability is cataloged as CVE-2019-0881. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows (Operating System). It has been classified as critical. This affects an unknown functionality of the component Kernel. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of Privilege Vulnerability'.

The bug was discovered 05/14/2019. The weakness was shared 05/14/2019 as confirmed security update guide (Website). The advisory is shared at portal.msrc.microsoft.com. The vendor cooperated in the coordination of the public release. This vulnerability is uniquely identified as CVE-2019-0881 since 11/26/2018. It is possible to initiate the attack remotely. The successful exploitation needs a authentication. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue. The advisory points out:

An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration. An attacker who successfully exploited the vulnerability could gain elevated privileges on a targeted system.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 91529 (Microsoft Windows Security Update for May 2019).

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (46912). The entries VDB-134678, VDB-134684, VDB-134698 and VDB-134699 are related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7 SP1
• 8.1
• 10
• 10 1607
• 10 1703
• 10 1709
• 10 1803
• 10 1809
• 10 1903
• RT 8.1
• Server 1803
• Server 1903
• Server 2008 R2 SP1
• Server 2008 SP2
• Server 2012
• Server 2012 R2
• Server 2016
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion