SandboxEscaper publishes Windows 10 privilege escalates zero-day vulnerability

The female hacker active on Twitter once again announced the Windows 10 zero-day vulnerability. This zero-day vulnerability is similar to the previous one, mainly due to local privilege escalation. Of course, the details of the female hacker’s previous style of vulnerability were also announced. She also produced a short video to demonstrate the exploitation of this vulnerability.

At present, this vulnerability has been confirmed by the Computer Emergency Response Team. It is reasonable to say that Microsoft should also receive an emergency response team notification at this time. The vulnerability has been tested to affect Windows 10 Version 1809 and 1903. If there are no surprises, the previous version should also have this vulnerability.

“It’s going to increase the thread priority to increase our odds of winning the race condition that this exploits. If your VM freezes, it means you either have 1 core or set your VM to have multiple processors instead of multiple cores… which will also cause it to lock up,” SandboxEscaper explains. “This bug is most definitely not restricted to the edge. This will be triggered with other packages too. So you can definitely figure out a way to trigger this bug silently without having edge pop up. Or you could probably minimize edge as soon as it launches and closes it as soon as the bug completes. I think it will also trigger by just launching edge once, but sometimes you may have to wait for a little. I didn’t do extensive testing…found this bug and quickly wrote up a PoC, took me like 2 hours total, finding LPEs is easy.”

Perhaps, this vulnerability will be fixed in the routine update of the following month.

Via: thehackernews