{"id":12837,"date":"2012-06-14T10:58:45","date_gmt":"2012-06-14T09:58:45","guid":{"rendered":"https:\/\/aidanfinn.com\/?p=12837"},"modified":"2012-06-14T10:58:45","modified_gmt":"2012-06-14T09:58:45","slug":"sysret-64-bit-os-privilege-escalation-vulnerability-on-intel-cpu-hardware","status":"publish","type":"post","link":"https:\/\/aidanfinn.com\/?p=12837","title":{"rendered":"SYSRET 64-bit OS Privilege Escalation Vulnerability On Intel CPU Hardware"},"content":{"rendered":"

CERT reported that<\/a>:<\/p>\n

\n

Some 64-bit operating systems and virtualization software running on Intel CPU hardware are vulnerable to a local privilege escalation attack. The vulnerability may be exploited for local privilege escalation or a guest-to-host virtual machine escape.<\/p>\n<\/blockquote>\n

That last bit is the piece that should concern you. Microsoft responded with one of this month\u2019s Patch Tuesday updates (thanks to Patrick Lownds<\/a> for the link).  MS12-042<\/a> fixes this issue and is distributed through the normal Windows Updates catalogue.<\/font><\/p>\n

\n

An elevation of privilege vulnerability exists in the way that the Windows User Mode Scheduler handles system requests. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.<\/p>\n<\/blockquote>\n

Mitigating factors for user mode scheduler memory corruption vulnerability:<\/p>\n