Microsoft Investigates New Zero Day Reported In Windows Kernel

Windows 7 and Vista also contain this new heap-overflow vulnerability, according to security researcher reports

Dark Reading logo in a gray background | Dark Reading

On the eve of one of the largest patch days of the year, Microsoft is investigating yet another zero-day flaw in Windows -- and one that affects even the newest versions of the operating system.

The heap-overflow flaw is in the Windows kernel and would allow an attacker to take control of targeted Windows XP SP3, Windows Server 2003 R2 Enterprise SP2, Windows Vista Business SP1, Windows 7, and Windows Server 2008 SP2 machines, according to advisories posted about the flaw in the past days. The flaw, along with a proof-of-concept (PoC), was disclosed by a researcher called "Arkon."

August already has been a busy month for Microsoft: After issuing an emergency patch last week for the recently exposed Windows Shell vulnerability (a.k.a. .LNK, the Windows shortcut link), Microsoft is set tomorrow to release 14 security bulletins patching 34 vulnerabilities. And now it's facing yet another zero-day investigation.

"Microsoft is investigating reports of a possible vulnerability in the Windows kernel. Upon completion of the investigation, Microsoft will take appropriate actions to protect customers," said Jerry Bryant, group manager for response communications at Microsoft, in a statement today.

Chaouki Bekrar CEO and director of research for VUPEN Security, says the buffer overflow flaw exists in the kernel-mode device driver, Win32k.sys. "The vulnerability can be exploited locally by an authenticated user to cause a Blue Screen of Death or potentially execute arbitrary code with elevated privileges and take complete control of the system," Bekrar says. VUPEN analyzed the flaw and confirmed its existence in the affected versions of Windows.

The PoC released by Arkon basically crashes a Windows machine; so far researchers haven't seen any exploits in the wild, but that could soon change given the usual pattern of disclosure lately.

VUPEN's Bekrar says there's no workaround for the flaw since it affects the kernel of the OS. For now, VUPEN recommends restricting local access to machines to "trusted users only," Bekrar says.

The danger of a kernel-level flaw is that it lets local users elevate their privileges and install programs, alter data, or create administrative accounts, he notes. "Also, this kind of local kernel vulnerability could be combined with remotely exploitable flaws to turn a client-side vulnerability into a 'ring0 exploit' and take complete control of the system," Bekrar says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author

Kelly Jackson Higgins, Editor-in-Chief, Dark Reading

Kelly Jackson Higgins is the Editor-in-Chief of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, Virginia Business magazine, and other major media properties. Jackson Higgins was recently selected as one of the Top 10 Cybersecurity Journalists in the US, and named as one of Folio's 2019 Top Women in Media. She began her career as a sports writer in the Washington, DC metropolitan area, and earned her BA at William & Mary. Follow her on Twitter @kjhiggins.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights