Microsoft Windows CSRSS Security Feature Bypass Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-28
• Known to be used in ransomware campaigns
• EPSS: 63% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

CISA: The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 18 Apr 2022): Apply updates per vendor instructions.

• Patch on docs.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• www.securitytracker.com/id/1035544Broken LinkThird Party AdvisoryVDB Entry
• docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-048PatchVendor Advisory
• www.exploit-db.com/exploits/39740ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource