Analysis of Microsoft Windows System 0day Vulnerability and Its Potential Impact

Recently, a security patch released by Microsoft fixed a Windows kernel privilege escalation vulnerability that was being exploited. This vulnerability mainly affects earlier versions of Windows and cannot be triggered on Windows 11. This article will delve into how such vulnerabilities are exploited in the current security environment.

A 0day vulnerability refers to a security flaw that is not yet public and has not been patched, which can be maliciously exploited by attackers without detection, causing significant damage. The recently discovered Windows 0day vulnerability allows hackers to gain complete control over the system, with consequences including the theft of personal information, system crashes, financial losses, and the implantation of malware. For Web3 users, this could result in stolen private keys and the transfer of digital assets. On a larger scale, this vulnerability could even affect the Web3 ecosystem that operates on Web2 infrastructure.

The analysis of the patch revealed that the problem lies in the reference counting handling of menu objects within window objects in the win32k code. The earlier code only locked the window object without locking the menu object within it, which could lead to incorrect references to the menu object.

To exploit this vulnerability, we constructed a special multi-layer nested menu structure and deleted some menu reference relationships at a critical moment. This allows the target menu object to be successfully released when the xxxRedrawTitle function returns to the user layer, resulting in subsequent kernel functions referencing invalid objects.

In practical use, we mainly consider two solutions: executing shellcode or modifying the token address using read/write primitives. Considering the security mechanisms of higher version Windows, we chose the latter. The specific implementation is divided into two steps: first, using the UAF vulnerability to control the value of cbwndextra, and then constructing stable read/write primitives.

We designed a memory layout that includes three consecutive HWND objects, successfully achieving the initial write to the target data by precisely controlling the object sizes and release order. Subsequently, we constructed stable read and write primitives using the GetMenuBarInfo() and SetClassLongPtr() functions, ultimately completing the modification of the system token.

Although Microsoft is restructuring the win32k code with Rust to completely address such issues, this still poses a serious security risk for many legacy systems in use. This vulnerability analysis also reflects that comprehensive code coverage testing and targeted detection of abnormal memory operations will be important ways to discover such vulnerabilities.