Microsoft Windows 7 SP1/Server 2008 R2 SP1/Server 2008 SP2 Win32k memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in Microsoft Windows 7 SP1/Server 2008 R2 SP1/Server 2008 SP2. The impacted element is an unknown function of the component Win32k. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2019-1364. The attack is possible to be carried out remotely. Moreover, an exploit is present. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Microsoft Windows 7 SP1/Server 2008 R2 SP1/Server 2008 SP2 (Operating System). It has been rated as critical. This issue affects some unknown functionality of the component Win32k. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1362.

The weakness was disclosed 10/08/2019 as confirmed security update guide (Website). The advisory is shared at portal.msrc.microsoft.com. The public release has been coordinated in cooperation with Microsoft. The identification of this vulnerability is CVE-2019-1364 since 11/26/2018. The attack may be initiated remotely. A simple authentication is required for exploitation. Technical details are unknown but a public exploit is available. The advisory points out:

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

A public exploit has been developed by Google Security Research and been published 2 days after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (47484). The entries VDB-143119, VDB-143118, VDB-143116 and VDB-143115 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7 SP1
• Server 2008 R2 SP1
• Server 2008 SP2

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion