PT-2012-2378 · Microsoft · Windows Vista+7
Published
2012-05-08
·
Updated
2025-01-21
·
CVE-2012-0180
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
win32k.sys versions in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview
Description
The issue arises from the improper handling of user-mode input passed to kernel mode for windows and messages, allowing local users to gain privileges via a crafted application. This could enable an attacker to run arbitrary code in kernel mode, potentially leading to the installation of programs, viewing, changing, or deleting data, or creating new accounts with full administrative rights.
Recommendations
For Microsoft Windows XP SP2 and SP3, consider applying security patches or updates to address the issue.
For Windows Server 2003 SP2, apply the relevant security update to fix the vulnerability.
For Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview, update to a newer version or apply the specific patch provided by Microsoft to resolve the issue.
As a temporary workaround, consider restricting access to the win32k.sys kernel-mode driver to minimize the risk of exploitation.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Windows
Windows 7
Windows 8
Windows Server 2003
Windows Server 2008
Windows Vista
Windows Xp
Win32K.Sys