KLA10985 Privilege escalation vulnerabilities in Windows kernel-mode drivers

Multiple cases of improper handling of objects in memory have been found in the Windows kernel-mode (Win32k) driver. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited remotely via a specially designed application by an attacker who has already logged on to the system.

Original advisories

MS17-018

CVE-2017-0056

CVE-2017-0024

CVE-2017-0026

CVE-2017-0078

CVE-2017-0079

CVE-2017-0080

CVE-2017-0081

CVE-2017-0082

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Windows-Vista-4

Microsoft-Windows-Server-2012

Microsoft-Windows-7

Microsoft-Windows-Server-2008

Windows-RT

Microsoft-Windows-10

CVE list

CVE-2017-0056 high

CVE-2017-0024 high

CVE-2017-0026 high

CVE-2017-0078 high

CVE-2017-0079 high

CVE-2017-0080 high

CVE-2017-0081 high

CVE-2017-0082 high

KB list

4012217

4012215

4012216

4012606

4013198

4013429

4012212

4012214

4012213

4012497

4013083

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Windows Vista Service Pack 2Windows 7 Service Pack 1Windows 8.1Windows RTWindows 10Windows Server 2008Windows Server 2008 R2Windows Server 2012Windows Server 2012 R2