You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
"description": "A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of\n NT AUTHORITY\\SYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being\n treated as an offset despite being populated by an attacker-controlled value. This can be leveraged to\n achieve an out of bounds write operation, eventually leading to privilege escalation.",
148241
+
"description": "The DBUtil_2_3.sys driver distributed by Dell exposes an unprotected IOCTL interface that can be abused by\n an attacker read and write kernel-mode memory.",
"Red Raindrop Team of Qi'anxin Threat Intelligence Center",
148293
+
"KaLendsi",
148294
+
"ly4k",
148295
+
"Grant Willcox"
148305
148296
],
148306
-
"description": "The DBUtil_2_3.sys driver distributed by Dell exposes an unprotected IOCTL interface that can be abused by\n an attacker read and write kernel-mode memory.",
148297
+
"description": "A use after free vulnerability exists in the `NtGdiResetDC()` function of Win32k which can be leveraged by\n an attacker to escalate privileges to those of `NT AUTHORITY\\SYSTEM`. The flaw exists due to the fact\n that this function calls `hdcOpenDCW()`, which performs a user mode callback. During this callback, attackers\n can call the `NtGdiResetDC()` function again with the same handle as before, which will result in the PDC object\n that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle\n with their own object, before passing execution back to the original `NtGdiResetDC()` call, which will now use the\n attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the\n kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\\SYSTEM.\n\n This module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions\n of Windows 10 will likely also work.",
"Red Raindrop Team of Qi'anxin Threat Intelligence Center",
148350
+
"BITTER APT",
148351
+
"JinQuan",
148352
+
"MaDongZe",
148353
+
"TuXiaoYi",
148354
+
"LiHao",
148355
+
"L4ys",
148358
148356
"KaLendsi",
148359
-
"ly4k",
148360
-
"Grant Willcox"
148357
+
"Spencer McIntyre"
148361
148358
],
148362
-
"description": "A use after free vulnerability exists in the `NtGdiResetDC()` function of Win32k which can be leveraged by\n an attacker to escalate privileges to those of `NT AUTHORITY\\SYSTEM`. The flaw exists due to the fact\n that this function calls `hdcOpenDCW()`, which performs a user mode callback. During this callback, attackers\n can call the `NtGdiResetDC()` function again with the same handle as before, which will result in the PDC object\n that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle\n with their own object, before passing execution back to the original `NtGdiResetDC()` call, which will now use the\n attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the\n kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\\SYSTEM.\n\n This module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions\n of Windows 10 will likely also work.",
148359
+
"description": "A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of\n NT AUTHORITY\\SYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being\n treated as an offset despite being populated by an attacker-controlled value. This can be leveraged to\n achieve an out of bounds write operation, eventually leading to privilege escalation.\n\n This flaw was originally identified as CVE-2021-1732 and was patched by Microsoft on February 9th, 2021.\n In early 2022, a technique to bypass the patch was identified and assigned CVE-2022-21882. The root cause is\n is the same for both vulnerabilities. This exploit combines the patch bypass with the original exploit to\n function on a wider range of Windows 10 targets.",
0 commit comments