Zero-Day Windows Kernel Flaw Linked to Clipboard

As the largest patch in Microsoft's Patch Tuesday history looms, the plot thickens.

Microsoft confirmed Monday that it is investigating reports of a new zero-day vulnerability in the Windows kernel. The flaw could affect systems running Windows 7, Windows Server 2008 Service Pack 2, Windows Server 2003 SP2, Windows Vista SP2 and Windows XP, according to security researchers.

Microsoft simply stated in its Twitter feed on Monday that "We are investigating a publicly reported vulnerability in Win32k.sys. We are not aware of any attacks against this issue. More info soon."

The response comes after two European security firms, Vupen and Secunia, released separate security advisories. Both of those advisories point to possible buffer overflows in the Windows kernel that can result in denial-of-service and elevation-of-privilege attacks.

Microsoft Security Response Center spokesperson Jerry Bryant said that Redmond was investigating the reports. He did not specify a timeline for a patch.

"Upon completion of the investigation, Microsoft will take appropriate actions to protect customers," Bryant said in a statement.

Microsoft could issue another out-of-band patch, as it did this month for a Windows flaw affecting shortcuts. However, security experts have said that it would probably take some in-the-wild exploit for Microsoft to release a security advisory, much less a patch, for this new zero-day flaw.

In describing the alleged flaw, France-based Vupen and Denmark's Secunia both pointed to a buffer overflow issue in the kernel-mode device driver Win32k.sys. The exploit appears to be associated with the Windows clipboard.

Vupen said the flaw enabled a buffer overflow error in the "CreateDIBPalette" function within Win32k.sys when using the "biClrUsed" member "while retrieving bitmap data from the clipboard." The flaw could enable remote code execution attacks on systems running Windows 7, Windows Server 2008, Windows Server 2003, Vista and Windows XP, according to Vupen.

Meanwhile, Secunia said a "boundary error" in Win32k.sys can be exploited via the "GetClipboardData" application programming interface (API) to cause a buffer overflow and enable elevation of administrative privileges on Windows 7, Windows XP SP3 and Windows Server 2008 SP2 operating systems only.

Tyler Reguly, lead security engineer at nCircle, said that the flaw has a lot to do with administrative access controls and it would require a more seasoned techie to execute the exploit.

"In the end, this is a privilege escalation issue at worst, and that means that something else is already on the system," Reguly said. "[The vulnerability] would need to be utilized in an attack chain of some sort. The attacker would need to first exploit the browser; then utilize CreateDIBPalette to escalate to higher privileges."

There's a flipside to that scenario if a user's browser already has administrative privileges. In that case, an attacker can simply skip the middle step of using the GetClipboardData or CreateDIBPalette vulnerability to escalate his privileges.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

comments powered by Disqus

Reader Comments:

Tue, Aug 10, 2010

MS needs to get out of CYA mode and place Win32K.sys back into formal code review and subject it to intensive fuzzing.

There are enough bread crumbs in the advisories for smarter BadGuys (TM) to begin coding up attackware for lesser minds to be able to put to use.

What planet does Reguly live on? "Combination" (chained) attacks are nothing new or rare.

Tue, Aug 10, 2010

Award-winning writing, my eye.

First off, it is a disservice not to provide links to the actual VUPEN and Secunia advisories about the same defect in Win32k.sys.

a buffer overflow error in the "CreateDIBPalette()" function within the kernel-mode device driver "Win32k.sys" when using the "biClrUsed" member value of a "BITMAPINFOHEADER" structure as a counter while retrieving Bitmap data from the clipboard, which could be exploited by malicious users to crash an affected system or potentially execute arbitrary code with kernel privileges.


a boundary error in win32k.sys within the "CreateDIBPalette()" function when copying colour values into a buffer allocated with a fixed size when creating the DIB palette. This can be exploited via the "GetClipboardData()" API to cause a buffer overflow by specifying a large number of colours (greater than 256) via the "biClrUsed" field in a BITMAPINFOHEADER structure.

Successful exploitation may allow execution of arbitrary code with kernel privileges.

Secondly, Reguly/nCircle has got no business dismissing the severity of the matter.

Both advisories cite buffer overflows and possible arbitrary code execution.

ASLR on 32-bit WinOSes has proven to not be much of a hurdle to defeat in terms of leveraging a variety of buffer overflows into arbitrary code execution.

The privilege elevation stated in both advisories is not about
Admin vs non-admin user accounts, it is about executing arbitrary code in kernel mode vs the same in user mode. Executing arbitrary code in kernel mode is more like owning the built-in System account. Whether or not the user is running as Admin or non-admin, Win32.sys runs as System, no matter what.

Add Your Comment Now:

Your Name:(optional)
Your Email:(optional)
Your Location:(optional)
Please type the letters/numbers you see above

Redmond Tech Watch

Sign up for our newsletter.

I agree to this site's Privacy Policy.