New Malware Delivery Technique Exploits Microsoft Teams

Overview of the Vulnerability

CVE-2023-29336 is a local privilege escalation vulnerability that affects the Win32k subsystem in older versions of Windows, including older versions of Windows 10, Windows Server, and Windows 8. It was originally discovered by the cybersecurity firm Avast and assigned a CVSS v3.1 severity rating of 7.8. The vulnerability allows low-privileged users to gain Windows SYSTEM privileges, which are the highest user mode privileges in Windows.

Exploitation Details

Researchers at the Web3 cybersecurity firm Numen have released full technical details on the CVE-2023-29336 vulnerability and a proof-of-concept (PoC) exploit for Windows Server 2016. The vulnerability resides in the Win32k subsystem (Win32k.sys kernel driver), which manages the operating system's window manager, screen output, input, and graphics.

Exploiting vulnerabilities in the Win32k subsystem often leads to elevated privileges or code execution. Numen's analysis found that the Win32k subsystem only locks the window object but fails to lock the nested menu object. This oversight, resulting from obsolete code being copied over to newer versions of Win32k, makes menu objects vulnerable to tampering or hijacking if attackers alter a specific address in the system memory. By taking control of the menu object, an attacker can gain the same-level access as the program that launched it. While this may not immediately grant admin-level privileges, it provides a starting point for subsequent steps that can help achieve such privileges.

The researchers experimented with various memory layout manipulation methods, exploit triggers, and memory read/write system functions. As a result, they developed a PoC exploit that reliably elevates privileges to SYSTEM level, which is the highest user privilege level in Windows. The report provides more technical details about the exploitation process. It states that aside from exploring different methods to gain control over the first write operation using reoccupied data from freed memory, there is usually no need for novel exploitation techniques. The vulnerability heavily relies on leaked desktop heap handle addresses. If this issue is not adequately addressed, older systems remain at risk.

Risk Assessment and Impact

The vulnerability poses a significant risk to older systems, although it is reportedly non-exploitable on Windows 11. The exploitation of this vulnerability does not require novel techniques but relies on leaked desktop heap handle addresses. System administrators should be vigilant for abnormal offset reads and writes in memory or related to window objects, which may indicate active exploitation for local privilege escalation.

Patch Information and Updates

Microsoft's May 2023 Patch Tuesday included fixes for three zero-day vulnerabilities, including CVE-2023-29336. The patch addressed a total of 38 flaws, including eight elevation of privilege vulnerabilities, four security feature bypass vulnerabilities, 12 remote code execution vulnerabilities, eight information disclosure vulnerabilities, five denial of service vulnerabilities, and one spoofing vulnerability. The patch is recommended for all Windows users to ensure their systems are protected against these vulnerabilities.

Recommendations

• To mitigate the risks associated with the CVE-2023-29336 vulnerability, applying the May 2023 patch released by Microsoft is crucial.

• Monitor memory for any abnormal offset reads and writes related to window objects, which may indicate active exploitation of the vulnerability.

• Regularly update operating systems.

Conclusion

CVE-2023-29336 represents a serious threat to older Windows systems, enabling local privilege escalation to SYSTEM level. The vulnerability exploits a flaw in the Win32k subsystem, allowing attackers to gain high-level access through relatively straightforward techniques. The release of the May 2023 patch by Microsoft is a critical measure for mitigating this risk. Organizations should apply this patch, monitor their systems for signs of exploitation, and maintain regular updates to safeguard against evolving threats. By implementing these recommendations, system administrators can better protect their systems from the potential impacts of this vulnerability.