Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-28

[ Description ]Official description

Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

CISA: Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 21 Apr 2022): Apply updates per vendor instructions.

• Patch on docs.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• isc.sans.edu/diary.htmlExploitIssue Tracking
• nakedsecurity.sophos.com/2010/11/25/new-windows-zero-day-flaw-bypasses-uacBroken Link
• secunia.com/advisories/42356Broken LinkVendor Advisory
• support.avaya.com/css/P8/documents/100127248Third Party Advisory
• twitter.com/msftsecresponse/statuses/7590788200402945Not Applicable
• www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirrorBroken LinkExploitThird Party Advisory
• www.exploit-db.com/exploits/15609ExploitThird Party AdvisoryVDB Entry
• www.kb.cert.org/vuls/id/529673Third Party AdvisoryUS Government Resource
• www.securityfocus.com/bid/45045Broken LinkThird Party AdvisoryVDB Entry
• www.securitytracker.com/idBroken LinkThird Party AdvisoryVDB Entry
• www.vupen.com/english/advisories/2011/0324Broken Link
• docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-011PatchVendor Advisory
• oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12162Broken Link
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource