PT-2011-3448 · Microsoft · Win32K.Sys+4

Published 2011-07-13 · Updated 2025-01-21 · CVE-2011-1887

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Vista versions SP1 through SP2 Windows Server 2008 versions Gold through R2 SP1 Windows 7 versions Gold through SP1

Description The issue allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference. An elevation of privilege vulnerability exists due to the way that Windows kernel-mode drivers manage pointers to kernel-mode driver objects. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode, then install programs, view, change, or delete data, or create new accounts with full administrative rights.

Recommendations For Windows Vista versions SP1 through SP2, consider restricting access to kernel-mode drivers to minimize the risk of exploitation. For Windows Server 2008 versions Gold through R2 SP1, avoid using crafted applications that could trigger a NULL pointer dereference until the issue is resolved. For Windows 7 versions Gold through SP1, as a temporary workaround, consider disabling the win32k.sys driver until a patch is available.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2011-1887

Affected Products

Windows

Windows 7

Windows Server 2008

Windows Vista

Win32K.Sys

References · 11

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1887 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1887 · Security Note
• https://docs.microsoft.com/security-updates/securitybulletins/2011/MS11-054 · Note
• http://support.avaya.com/css/P8/documents/100144947 · Note
• http://securityfocus.com/bid/48601 · Note
• http://secunia.com/advisories/45186 · Note
• http://us-cert.gov/cas/techalerts/TA11-193A.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12711 · Note
• http://osvdb.org/73789 · Note
• http://securitytracker.com/id?1025761 · Note