Microsoft Investigates New Zero Day Reported In Windows Kernel

On the eve of one of the largest patch days of the year, Microsoft is investigating yet another zero-day flaw in Windows -- and one that affects even the newest versions of the operating system.

The heap-overflow flaw is in the Windows kernel and would allow an attacker to take control of targeted Windows XP SP3, Windows Server 2003 R2 Enterprise SP2, Windows Vista Business SP1, Windows 7, and Windows Server 2008 SP2 machines, according to advisories posted about the flaw in the past days. The flaw, along with a proof-of-concept (PoC), was disclosed by a researcher called "Arkon."

August already has been a busy month for Microsoft: After issuing an emergency patch last week for the recently exposed Windows Shell vulnerability (a.k.a. .LNK, the Windows shortcut link), Microsoft is set tomorrow to release 14 security bulletins patching 34 vulnerabilities. And now it's facing yet another zero-day investigation.

"Microsoft is investigating reports of a possible vulnerability in the Windows kernel. Upon completion of the investigation, Microsoft will take appropriate actions to protect customers," said Jerry Bryant, group manager for response communications at Microsoft, in a statement today.

Chaouki Bekrar CEO and director of research for VUPEN Security, says the buffer overflow flaw exists in the kernel-mode device driver, Win32k.sys. "The vulnerability can be exploited locally by an authenticated user to cause a Blue Screen of Death or potentially execute arbitrary code with elevated privileges and take complete control of the system," Bekrar says. VUPEN analyzed the flaw and confirmed its existence in the affected versions of Windows.

The PoC released by Arkon basically crashes a Windows machine; so far researchers haven't seen any exploits in the wild, but that could soon change given the usual pattern of disclosure lately.

VUPEN's Bekrar says there's no workaround for the flaw since it affects the kernel of the OS. For now, VUPEN recommends restricting local access to machines to "trusted users only," Bekrar says.

The danger of a kernel-level flaw is that it lets local users elevate their privileges and install programs, alter data, or create administrative accounts, he notes. "Also, this kind of local kernel vulnerability could be combined with remotely exploitable flaws to turn a client-side vulnerability into a 'ring0 exploit' and take complete control of the system," Bekrar says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.