High
CVE-2019-1132
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
High
(4 users assessed)
Moderate
(4 users assessed)Unknown
Unknown
Unknown
CVE-2019-1132
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Privilege Escalation on Windows 7, Server 2008, and Server 2008 R2 targeting win32k.sys
Add Assessment
Ratings
-
Attacker ValueHigh
-
ExploitabilityMedium
Technical Analysis
This vulnerability takes advantage of a null pointer dereference within the Windows win32k.sys driver, win32k.sys is notorious for including GDI objects and other objects that can be abused and utilized for various types of exploitation. This vulnerability takes advantage of pop-up menu objects, and exploitation of this vulnerability can grant the user system access, AKA Escalation of privilege. This vulnerability displays a menu using the TrackPopupMenu function, And code that is hooked to EVENT_SYSTEM_MENUPOPUPSTART gets executed.
This vulnerability also flips the bServerSideWindowProc bit within the tagWND data structure, Also it utilizes the tagWND structure to leak kernel memory addresses.
This vulnerability seems to be mitigated on the newer versions of windows, within Windows 8.1 with the introduction of various mitigations, null pointer dereference vulnerabilities stopped existing. And on some newer and more previous windows 10 security updates, there have been mitigations to prevent kernel address leakage from the tagWND structure.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild Report
Ratings
-
Attacker ValueMedium
-
ExploitabilityLow
Technical Analysis
This is a priv esc being used in the wild. It targets older versions of Windows, with part of the path to execution stopped in recent Workstation OS internal changes. If you are running the affected OS, you should patch and think about upgrading the OS to something released in the last decade.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild Report
Technical Analysis
Reported as exploited in the wild as part of Google’s 2020 0day vulnerability spreadsheet they made available at https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit#gid=1869060786. Original tweet announcing this spreadsheet with the 2020 findings can be found at https://twitter.com/maddiestone/status/1329837665378725888
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild Report
Technical Analysis
This is another priv esc in the win32k.sys system. It leverages windows popup windows to craft a race condition to overwrite an allocated section of memory, then hand that memory location to a funtion that executes it in Kernel mode.
It is being actively used in the wild.
The mitigations are pretty strong. Microsoft released a patch, and internal security controls on Windows 8 and above prevent writing to the allocated memory, so while the exploit might be present on later systems, it is not usable. In the writeup by the discoverer, (s)he claims that the fix in Windows 8 was backported to Windows 7x64 systems, but lists SP1 as vulnerable. I assume this means the fix was in a patch release.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportGeneral Information
Exploited in the Wild
Would you like to delete this Exploited in the Wild Report?
Yes, delete this reportReferences
Miscellaneous
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
