Microsoft Windows splWOW64 Privilege Escalation
Posted by deepcore on December 24, 2020 – 2:55 am
CVE-2020-0986, which was exploited in the wild, was not fixed. The vulnerability still exists, just the exploitation method had to change. A low integrity process can send LPC messages to splwow64.exe (Medium integrity) and gain a write-what-where primitive in splwow64’s memory space. The attacker controls the destination, the contents that are copied, and the number of bytes copied through a memcpy call.
Post a reply
You must be logged in to post a comment.