Security Advisory SSA-1712

Microsoft Windows win32kfull Integer Overflow Code Execution Vulnerability

Reference ID: SSA-1712
Publication date: 12.09.2017
Severity: critical
Discovered by: Sebastian Apelt

Affected products/versions:
Microsoft Windows 10 (x86 and x64)

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the win32kfull driver. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges to the level of SYSTEM.

Please read our blog post for further details about this vulnerability and its exploitation under the latest Windows 10 version.

References:
Blog Post
ZDI Advisory CVE-2016-0165
Microsoft’s Updated Advisory for CVE-2016-0165