Win32k ConsoleControl Offset Confusion
Posted by deepcore on March 20, 2021 – 5:32 pm
A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of NT AUTHORITYSYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being treated as an offset despite being populated by an attacker-controlled value. This can be leveraged to achieve an out of bounds write operation, eventually leading to privilege escalation.
Post a reply
You must be logged in to post a comment.