News

Zero-Day Windows Kernel Flaw Linked to Clipboard

• By Jabulani Leffall
• 08/09/2010

As the largest patch in Microsoft's Patch Tuesday history looms, the plot thickens.

Microsoft confirmed Monday that it is investigating reports of a new zero-day vulnerability in the Windows kernel. The flaw could affect systems running Windows 7, Windows Server 2008 Service Pack 2, Windows Server 2003 SP2, Windows Vista SP2 and Windows XP, according to security researchers.

Microsoft simply stated in its Twitter feed on Monday that "We are investigating a publicly reported vulnerability in Win32k.sys. We are not aware of any attacks against this issue. More info soon."

The response comes after two European security firms, Vupen and Secunia, released separate security advisories. Both of those advisories point to possible buffer overflows in the Windows kernel that can result in denial-of-service and elevation-of-privilege attacks.

Microsoft Security Response Center spokesperson Jerry Bryant said that Redmond was investigating the reports. He did not specify a timeline for a patch.

"Upon completion of the investigation, Microsoft will take appropriate actions to protect customers," Bryant said in a statement.

Microsoft could issue another out-of-band patch, as it did this month for a Windows flaw affecting shortcuts. However, security experts have said that it would probably take some in-the-wild exploit for Microsoft to release a security advisory, much less a patch, for this new zero-day flaw.

In describing the alleged flaw, France-based Vupen and Denmark's Secunia both pointed to a buffer overflow issue in the kernel-mode device driver Win32k.sys. The exploit appears to be associated with the Windows clipboard.

Vupen said the flaw enabled a buffer overflow error in the "CreateDIBPalette" function within Win32k.sys when using the "biClrUsed" member "while retrieving bitmap data from the clipboard." The flaw could enable remote code execution attacks on systems running Windows 7, Windows Server 2008, Windows Server 2003, Vista and Windows XP, according to Vupen.

Meanwhile, Secunia said a "boundary error" in Win32k.sys can be exploited via the "GetClipboardData" application programming interface (API) to cause a buffer overflow and enable elevation of administrative privileges on Windows 7, Windows XP SP3 and Windows Server 2008 SP2 operating systems only.

Tyler Reguly, lead security engineer at nCircle, said that the flaw has a lot to do with administrative access controls and it would require a more seasoned techie to execute the exploit.

"In the end, this is a privilege escalation issue at worst, and that means that something else is already on the system," Reguly said. "[The vulnerability] would need to be utilized in an attack chain of some sort. The attacker would need to first exploit the browser; then utilize CreateDIBPalette to escalate to higher privileges."

There's a flipside to that scenario if a user's browser already has administrative privileges. In that case, an attacker can simply skip the middle step of using the GetClipboardData or CreateDIBPalette vulnerability to escalate his privileges.