CVE-2019-1132

Privilege Escalation on Windows 7, Server 2008, and Server 2008 R2 targeting win32k.sys

Recent assessments:

FULLSHADE at April 21, 2020 4:04am UTC reported:

This vulnerability takes advantage of a null pointer dereference within the Windows win32k.sys driver, win32k.sys is notorious for including GDI objects and other objects that can be abused and utilized for various types of exploitation. This vulnerability takes advantage of pop-up menu objects, and exploitation of this vulnerability can grant the user system access, AKA Escalation of privilege. This vulnerability displays a menu using the TrackPopupMenu function, And code that is hooked to EVENT_SYSTEM_MENUPOPUPSTART gets executed.

This vulnerability also flips the bServerSideWindowProc bit within the tagWND data structure, Also it utilizes the tagWND structure to leak kernel memory addresses.

This vulnerability seems to be mitigated on the newer versions of windows, within Windows 8.1 with the introduction of various mitigations, null pointer dereference vulnerabilities stopped existing. And on some newer and more previous windows 10 security updates, there have been mitigations to prevent kernel address leakage from the tagWND structure.

bwatters-r7 at July 10, 2019 1:02pm UTC reported:

This vulnerability takes advantage of a null pointer dereference within the Windows win32k.sys driver, win32k.sys is notorious for including GDI objects and other objects that can be abused and utilized for various types of exploitation. This vulnerability takes advantage of pop-up menu objects, and exploitation of this vulnerability can grant the user system access, AKA Escalation of privilege. This vulnerability displays a menu using the TrackPopupMenu function, And code that is hooked to EVENT_SYSTEM_MENUPOPUPSTART gets executed.

This vulnerability also flips the bServerSideWindowProc bit within the tagWND data structure, Also it utilizes the tagWND structure to leak kernel memory addresses.

This vulnerability seems to be mitigated on the newer versions of windows, within Windows 8.1 with the introduction of various mitigations, null pointer dereference vulnerabilities stopped existing. And on some newer and more previous windows 10 security updates, there have been mitigations to prevent kernel address leakage from the tagWND structure.

gwillcox-r7 at November 22, 2020 2:46am UTC reported:

This vulnerability takes advantage of a null pointer dereference within the Windows win32k.sys driver, win32k.sys is notorious for including GDI objects and other objects that can be abused and utilized for various types of exploitation. This vulnerability takes advantage of pop-up menu objects, and exploitation of this vulnerability can grant the user system access, AKA Escalation of privilege. This vulnerability displays a menu using the TrackPopupMenu function, And code that is hooked to EVENT_SYSTEM_MENUPOPUPSTART gets executed.

This vulnerability also flips the bServerSideWindowProc bit within the tagWND data structure, Also it utilizes the tagWND structure to leak kernel memory addresses.

This vulnerability seems to be mitigated on the newer versions of windows, within Windows 8.1 with the introduction of various mitigations, null pointer dereference vulnerabilities stopped existing. And on some newer and more previous windows 10 security updates, there have been mitigations to prevent kernel address leakage from the tagWND structure.

asoto-r7 at September 12, 2019 6:06pm UTC reported:

This vulnerability takes advantage of a null pointer dereference within the Windows win32k.sys driver, win32k.sys is notorious for including GDI objects and other objects that can be abused and utilized for various types of exploitation. This vulnerability takes advantage of pop-up menu objects, and exploitation of this vulnerability can grant the user system access, AKA Escalation of privilege. This vulnerability displays a menu using the TrackPopupMenu function, And code that is hooked to EVENT_SYSTEM_MENUPOPUPSTART gets executed.

This vulnerability also flips the bServerSideWindowProc bit within the tagWND data structure, Also it utilizes the tagWND structure to leak kernel memory addresses.

This vulnerability seems to be mitigated on the newer versions of windows, within Windows 8.1 with the introduction of various mitigations, null pointer dereference vulnerabilities stopped existing. And on some newer and more previous windows 10 security updates, there have been mitigations to prevent kernel address leakage from the tagWND structure.

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 3