Zero-day vulnerability in Windows

NULL pointer dereference
CVE-2019-0808

On March 7th Google has reported in the wild exploitation of vulnerability in Microsoft Windows. During the attack the adversary used another zero-day vulnerability in Google Chrome in order to execute code on the system and vulnerability in Microsoft Windows to escalate privileges.
The initial attack was detected in late February.

Vulnerability details

Advisory: SB2019030802 - Privilege escalation in Microsoft Windows

Vulnerable component: Windows

CVE-ID: CVE-2019-0808

CVSSv3 score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C

CWE-ID: CWE-476 - NULL Pointer Dereference

Description:

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a NULL pointer dereference error in the win32k!MNGetpItemFromIndex when NtUserMNDragOver() system call within the win32k.sys kernel driver. A local user can use a specially crafted application to escape sandbox and execute arbitrary code on the target system with SYSTEM privileges.

Note, this vulnerability is being actively exploited in the wild along with vulnerability in Google Chrome described in (SB2019030405).

Public Exploits:

- Microsoft Windows 7/2008 - 'Win32k' Denial of Service (PoC) [Exploit-DB]

External links:

About zero-day vulnerabilities

Zero-day vulnerability is an undisclosed vulnerability in software that hackers can exploit to compromise computer programs, gain unauthorized access to sensitive data, penetrate networks, etc. We consider vulnerability a zero-day when there is no solution provided from software vendor and the vulnerability is being actively exploited by malicious actors.

Zero-day candidate is a potential zero-day vulnerability in software which might have been used in targeted attacks, however there is no evidence to support this suggestion.