Security Experts Highlight Exploit for Patched Windows Flaw

Security researchers have identified and launched details about an actively exploited Microsoft Windows security flaw that could let menace actors to achieve elevated privileges on impacted devices. 

Tracked as CVE-2023-29336 and rated 7.8 in CVSS severity, the vulnerability is connected to an elevation of privilege bug in the Win32k component of Windows. A patch for the flaw was unveiled by Microsoft as element of the May perhaps 2023 Patch Tuesday update.

Examine more on the newest Patch Tuesday: Microsoft Patches 3 Zero-Day Bugs This Month

Whilst the correct details of the in-the-wild exploitation continue to be mysterious, cybersecurity business Numen Cyber has deconstructed the patch unveiled by Microsoft and developed a evidence-of-idea (PoC) exploit for Windows Server 2016.

In its advisory, Numen Cyber highlighted that Win32k vulnerabilities have a heritage. Microsoft has attempted to refactor this component of the kernel code working with Rust in the most up-to-date Windows 11 preview edition, which may perhaps do away with this sort of vulnerabilities in the foreseeable future.

The vulnerability makes it possible for low-privileged people to receive Process privileges, the greatest user mode privileges in Windows. Cybersecurity company Avast was initially credited with discovering the flaw, revealing that it was actively exploited as a zero-working day in assaults.

Rapidly ahead to this 7 days, Numen Cyber warned that exploiting this vulnerability does not involve novel methods and seriously relies on leaked desktop heap cope with addresses. Consequently, more mature devices continue to be at risk if this issue is not tackled carefully.

“While this vulnerability appears to be to be non-exploitable on the Acquire11 method variation, it poses a substantial risk to before systems,” reads the technical generate-up.

Technique directors are encouraged to be vigilant for irregular offset reads and writes in memory or similar to window objects, as they may show energetic exploitation of CVE-2023-29336 for regional privilege escalation.

More vulnerabilities perhaps allowing for attackers to obtain elevated privileges have been lately discovered in the popular graphics debugger RenderDoc.

Image credit: diy13 / Shutterstock.com

Some parts of this article are sourced from:
www.infosecurity-magazine.com