Tag Archives: Microsoft Windows

Linux and Windows Address Page Cache Vulnerabilities

In early January security researchers located further vulnerabilities in how Windows and Linux operating systems use a memory page cache.

How severe are these vulnerabilities and what is their impact?
One of the co-authors of the academic paper disclosing these vulnerabilities described the work as mostly “a matter of academic interest” meaning that attackers are less likely to take advantage of these vulnerabilities.

Local attacks:
For the localised rather than remote variant of utilizing these vulnerabilities; the attacker must already have gained access to the victim system to read the target memory page. The attacker could do this by “[having a] malicious process on the operating system or when processes run in sandboxes that have shared files”.

Other actions an attacker could potentially carry out are:

• Cloning an open window and replacing the legitimate application window
• Gathering the root (Linux) or administrator (Windows) password

Remote attack:
To exploit the vulnerabilities remotely; the researchers leveraged “timing differences between memory and disk access, measured on a remote system, as a proxy for the required local information”. This was achieved by measuring the times when soft page faults (the page is erroneously mapped, with the help of a process that runs on a remote server) occurred. The researchers were successful in sending data covertly from an unprivileged malicious process within the victim system to a remote server fulfilling the role of a web server. They used a technique from previous research namely the NetSpectre attack to distinguish cache hits and misses over a network connection. This was successful on systems with mechanical hard drives (HDDs) and solid-state disks (SSDs). SSDs were more complex since the timing differences were smaller but the researchers compensated by using larger files to distinguish between cache hits and misses.

How can I protect my organization/myself from these vulnerabilities?
Since these vulnerabilities are more academic in nature; attackers are less likely to exploit them. Linus Torvalds has explained that the code to resolve this vulnerability has been checked in and is undergoing testing before being more widely rolled out. For Windows; Build 18305 of the upcoming Windows 19H1 (otherwise known as Version 1903) due for release in April 2019 contains fixes for these vulnerabilities. It is anticipated Microsoft will back-port this patch to earlier Windows versions.

In addition; the mitigations for the Spectre vulnerabilities from last year should address the remote attack vector using the NetSpectre attack method.

Why are there so many timing attacks being disclosed lately?
Since modern systems rely on timing for almost every component e.g. the CPU (internal caches and registers respond in nanoseconds (ns)), the memory/RAM (e.g. CAS latency), HDDs (measured in milliseconds (ms) e.g. 8.9 ms), SSDs (e.g. 0.05 ms , much faster) we are likely to continue to see further vulnerabilities disclosed as further scrutiny is applied to devices and architectures that have been in use for many years.

E.g. the affected code from Linux was timestamped in 2000 and stated that further revision should be carried out when more information was known. 19 years later we know more and are revising that code. It’s a similar situation with Windows where the revised code works to ensure low privilege processes can no longer access page cache information or shared cache information. As The Register points out; “something complex that’s just working can remain untouched for a very long time, lest someone breaks it” and is more likely to contain vulnerabilities since nobody has taken the time to look for what has been there for years.

Thank you.

December 2018: Further Zero Day Vulnerabilities Disclosed

In the 3rd week of December; a security researcher using the name SandboxEscaper (who we have discussed twice before on this blog) announced a 3rd zero-day (defined) vulnerability followed by a 4th on the 30th of December.

For the 3rd vulnerability: Windows 7 and Windows 10 are confirmed as impacted. Windows 8.1 may also be vulnerable. For the 4th vulnerability; Windows 10 Version 1803 (Build 17134) has been confirmed as impacted (it’s unknown if newer builds of Window 10 or if Windows 7/8.1 are vulnerable).

How severe are these vulnerabilities and what is their impact?
I’ll break these into 2 sections:

Vulnerability 3:
Arbitrary file read issue: Uses MsiAdvertiseProduct:
From the limited information available this vulnerability does not appear to be remotely exploitable. The attacker would already need to have compromised an account on your Windows system in order to run the necessary proof of concept code. This vulnerability should be considered medium but not critical severity. When exploited it can allow an attacker to read/copy any files they choose using the permissions from the Windows Installer Service namely LocalSystem privileges (the highest level of privilege)(defined). The vulnerability makes use of a time to check to time to use (TOCTOU) race condition type.

In the same manner as the previous vulnerabilities it may be leveraged in the wild before it is patched by Microsoft; this is my reason for advising exercising caution with email and clicking unexpected links (within emails, links within IM clients or social networks). Security researcher Will Dormann found this exploit inconsistent when used. Meanwhile Acros Security CEO Mitja Kolsek stated It was very likely a micropatch for this exploit would be available before the holiday period.

Vulnerability 4:
Arbitrary file overwrite issue: Proof of concept overwrites pci.sys
As above; this vulnerability does not appear to be remotely exploitable. The attacker would already need to have compromised an account on your Windows system in order to run the necessary proof of concept code. This vulnerability should be considered medium but not critical severity. When exploited it can allow an attacker to overwrite pci.sys with information about software and hardware problems, collected through the Windows Error Reporting (WER) but the attacker can also influence what data is used to overwrite the original file. The vulnerability again makes use of a race condition which means that the exploit doesn’t always provide the attacker with the intended result. This is especially true for systems with a single CPU core.

However; the choice of pci.sys for the proof of concept was an example; any file could be used (confirmed by Will Dormann).

How can I protect my organization/myself from these vulnerabilities?
The same advice issued for the first two zero day disclosures again applies here. This US-CERT advisory also provides advice for safely handling emails.

If you wish to deploy the micropatch from the firm 0patch; please test how well it works in your environment thoroughly BEFORE deployment in your production environment.

It can be obtained by installing and registering 0patch Agent from https://0patch.com Such micropatches usually install and need no further action when Microsoft officially patches the vulnerability since the micropatch is only active when a vulnerable version of the affected file is used; once patched the micropatch has no further effect (it is then unnecessary).

Thank you.

Oracle VirtualBox Zero Day Disclosed

In early November a security researcher publicly disclosed (defined) a zero day (defined) vulnerability within Oracle’s VirtualBox virtualisation software.

How severe is this vulnerability?
In summary; this vulnerability is serious but it could have been worse. In order to exploit it, an attacker would first need to have obtained elevated privileges on your system; root (defined) in the case of Linux and administrator (defined) in the case of Windows. Using this privilege the attacker can leverage the exploit to escape from the confines of the virtual machine (VM)(defined) into the system which hosts the virtual machine (in other words; the system which houses the virtual machine within its physical infrastructure). Once outside of the virtual machine the attacker must then elevate their privileges again since breaking out of the VM only gives them user level/standard privileges and not elevated privileges in the physical system. Thus the attacker would then need to use a separate exploit for another vulnerability (not related to this VirtualBox flaw) to elevate their privileges again to become root/admin within the physical system.

Obviously; the consequences of exploiting this vulnerability on a shared service/cloud infrastructure system would be more serious since multiple users would be affected all at once and the further exploitation of the resulting host systems could potentially provide the attacker with control over all the virtual machines.

How can an attacker exploit this vulnerability?
VirtualBox makes use of the Intel Pro/1000 MT Desktop (82540EM) network adapter to provide an internet connection to the virtual machines it manages. The attacker must first turn off this adapter in the guest (virtualised) operating system. Once complete they can then load a custom Linux kernel module (LKM)(defined) (this does not require a reboot of the system). That custom LKM contains the exploit derived from the technical write up provided. That new LKM loads its own custom version of the Intel network adapter. Next the LKM exploits a buffer overflow (defined) vulnerability within the virtualised adapter to escape the guest operating system. The attack must then unload the custom LKM to re-enable the real Intel adapter to resume their access to the internet.

How can I protect myself from this vulnerability?
While this is a complex vulnerability to exploit (an attacker would need to chain exploits together in order to elevate their privilege on the host system after escaping the VM), the source code needed to do so is available in full from the researcher’s disclosure; increasing the risk of it being used by attackers.

At the time of writing; this vulnerability has not yet been patched by VirtualBox. It affects versions 5.2.20 and earlier when installed on Ubuntu version 16.04 and 18.04 x86-64 guests (Windows is believed to be affected too). While a patch is pending; you can change the network card type to PCnet or Para virtualised Network. If this isn’t an option available or convenient for you; you can an alternative to the NAT mode of operation for the network card.

Thank you.

Protecting Against the Microsoft JET Database Zero Day Vulnerability

Update: 9th January 2019:
Microsoft have now resolved the unpatched JET vulnerability. It has been designated as CVE-2019-0579. It appears it took extra time since binary differential analysis shows that larger sections of the file msrd3x40.dll have been re-designed to proactively mitigate future vulnerabilities.

Further details are located here. Thank you.

Update: 3rd January 2019:
As of the 19th of December; the firm 0patch have confirmed the incomplete patch for this vulnerability has not yet been revised by Microsoft.

Update: 24th October 2018:
According to Acros Security CEO Mitja Kolsek the fix for this vulnerability from Microsoft is incomplete and mitigates but does not resolve the vulnerability.

As before; my assessment of the difficulty an attacker would face in exploiting this vulnerability remains accurate. The attack first needs you to take an action you wouldn’t otherwise take; if you don’t they can’t compromise your system.

Details of the incomplete nature of the vulnerability are not being disclosed while the patch is re-evaluated. Acros Security has notified Microsoft of this incomplete fix and is awaiting a response. In the meantime; their micropatch completely mitigates the vulnerability.

I’ll keep this post updated as more details become available. Thank you.

Update: 9th October 2018:
Microsoft’s scheduled updates for October 2018 resolve this vulnerability. Thank you.

Original Post:
In the latter half of last week; Trend Micro’s Zero Day Initiative publically disclosed (defined) a zero day vulnerability (defined) within the Microsoft JET Database Engine (defined).

Why should this vulnerability be considered important?
This vulnerability should be considered high but not critical severity. When exploited it can allow an attacker to execute code (to carry out any action of their choice) but they cannot initiate this automatically/remotely. They must socially engineer a potential victim into opening an attachment ( most likely sent over email or via instant messaging etc.). This attachment would need to be a specific file containing data stored in the JET database format. Another means would be visiting a webpage but 0patch co-founder Mitja Kolsec could not successfully test this means of exploit.

This vulnerability exists on Windows 7 but is believed to also exist on all versions of Windows including the Server versions.

How can I protect my organization/myself from this vulnerability?
At this time; a patch/update from Microsoft is pending and is expected to be made available in October’s Update Tuesday (9th October).

In the meantime; please continue to exercise standard vigilance in particular when using email; e.g. don’t click on suspicious links received within emails, social media, via chat applications etc. Don’t open attachments you weren’t expecting within an email (even if you know the person; since their email account or device they access their email may have been compromised) and download updates for your software and devices from trusted sources e.g. the software/device vendors. This US-CERT advisory also provides advice for safely handling emails.

If you choose to; the firm 0patch has also issued micro-patch for this vulnerability as a group of two patches. This was the same firm who micro-patched the recent Windows Task Scheduler vulnerability. As with the above mitigations; if you wish to deploy this micropatch please test how well it works in your environment thoroughly BEFORE deployment.

Thank you.

Adobe Issues Further Security Updates

Early last week Adobe made available a further un-scheduled emergency security update available for download affecting Creative Cloud Desktop Application version 4.6.0 and earlier. This vulnerability impacts both Apple macOS and Windows systems.

If an attacker were to exploit this they could elevate their privileges (defined). As with the previous security update the vulnerability was responsibly disclosed (defined) to Adobe by Chi Chou of AntFinancial LightYear Labs.

Please follow the steps within this security bulletin to check if the version of Creative Cloud Desktop Application you are using is impacted and if so; follow the steps to install the relevant update.

Thank you.

Adobe Issues Critical Photoshop CC Security Updates

On Wednesday Adobe made available an out of band (un-scheduled) emergency update available for Photoshop CC for both Apple macOS and Windows systems.

Photoshop CC 2018 (versions 19.1.5 and earlier) and Photoshop 2017 (versions 18.1.5 and earlier) are affected by two critical memory corruption vulnerabilities. If an attacker were to exploit these they could achieve remote code execution (defined: the ability for an attacker to remotely carry out any action of their choice on your device). The vulnerabilities were responsibly disclosed (defined) by Kushal Arvind Shah of Fortinet’s FortiGuard Labs to Adobe.

Please follow the steps within Adobe’s security bulletin to install the applicable updates as soon as possible if you use these products.

Thank you.

Intel Lazy Floating Point Vulnerability: What you need to know

Update: 24th July 2018:
I have updated the list of vendor responses below to include further Red Hat versions and CentOS:

Red Hat Enterprise Linux 6:

Red Hat Enterprise Linux 5 and 7:

CentOS 6:

CentOS 7:


On Wednesday of last week, a further vulnerability affecting Intel CPUs (defined) was disclosed.

TL;DR: Keep your operating system up to date and you should be fine.

What makes this vulnerability noteworthy?
According to Intel’s security advisory; this is an information disclosure issue. Similar to Spectre/Meltdown the flaw is the result of a performance optimization (used when saving and restoring the current state of applications as a system switches from one application to another). A feature known as Lazy Floating Point (defined) Unit (FPU) is used to save and restore registers (defined) within the CPU used to store floating point numbers (non-integers numbers, namely decimal numbers).

The issue is that these registers may be accessed by another application on the same system. If the registers are storing for example results of performing cryptographic equations for a key you have just created or used to decrypt data, the attacker could use this data to infer what the actual key is. The same applies for any type of data the registers store; that data can be used to infer what the previous contents were via a speculative execution side channel.

This vulnerability has been rated as moderate since it is difficult to exploit via a web browser (in contrast to Spectre) and the updates will be a software update only; no microcode (defined) and/or firmware (defined) updates will be necessary. With exploitation via a web browser being difficult; this vulnerability will likely instead be exploited from the victim system (at attacker will need to have already compromised your system).

How can I protect myself from this vulnerability?
Please note; AMD CPUs are NOT affected by this vulnerability.

The following vendors have responded to this vulnerability with software updates now in progress. Separately Red Hat has completed their updates for Red Hat Linux 5, 6 and 7 (with further applicable updates still in progress).

Other vendors responses are listed below. Thank you:

Amazon Web Services

Apple (currently release notes for an update to macOS to resolve the vulnerability)


Intel’s Security Advisory


Microsoft Windows


Xen Project