Experts published details of the actively exploited CVE-2019-0808 Windows Flaw

Read Time1 Minute, 39 Second

Experts from Qihoo 360 disclosed technical details of the actively exploited Windows zero-day flaw CVE-2019-0808 recently patched by Microsoft.

Researchers at the security firm Qihoo 360 disclosed technical details of the zero-day vulnerability CVE-2019-0808 that was recently patched by Microsoft.

The vulnerability was reported to Microsoft by researchers from Google’s Threat Analysis Group that observed it had been exploited alongside CVE-2019-5786, a Chrome vulnerability patched early March.

Microsoft addressed the flaw with the release of the Patch Tuesday security updates for March 2019.

At the time of the public disclosure, Google did not reveal technical information about the Windows zero-day.

The CVE-2019-0808 vulnerability affects the windows Win32k component and could be exploited by an authenticated attacker to elevate privileges and execute arbitrary code in kernel mode. An attacker can chain the flaw with a web browser vulnerability to escape sandboxes.

The vulnerability only affects Windows 7 and Windows Server 2008 because Windows 10 includes implements mitigations that don’t allow its exploitation.

Now the researchers at Qihoo 360 shed the light on the flaw and the way to exploit it, they described the root cause with the following statement:

“After receiving the menu window object returned by the window procedure function, the xxxMNFindWindowFromPoint function does not effectively check the validity of its member tagPOPUPMENU, causing the subsequent MNGetpItemFromIndex function to trigger the NULL pointer deference.”

The experts explained how to trigger the flaw and provided details on how Microsoft has fixed the problem.

The researchers also developed a PoC exploit that have only partially disclosed. Anyway, the analysis published by the researchers includes step-by-step instructions on the main phases of the exploitation process.