Vulnerability Disclosure: Windows 10 Denial of Service

A Windows 10 zero day vulnerability was publicly released on December 25th, with proof-of-concept (PoC) code released several days later. This zero day is both less reliable and impactful than previous zero days recently released for Windows 10. This vulnerability allows for a denial-of-service attack on a Windows 10 machine from a user account lacking administrative privileges.

Recommendations

Microsoft has yet to issue a patch for this issue. Given the reliability issues surrounding this particular vulnerability, malware authors are unlikely to widely adopt it. We recommend:

• Implementing a custom rule in the ZeroFOX platform to monitor for reports of vulnerabilities that may affect your technical stack; and
• Patching your systems regularly and following recommendations for out-of-band patch updates.

Details

A security researcher known as SandboxEscaper announced on Twitter on December 25th that she had discovered a Windows 10 zero day. According to her posts, she notified Microsoft about this vulnerability before publicly releasing it. She uploaded PoC code to her Github repository on the 28th.

The PoC demonstrates the ability to overwrite system files with information collected from Windows Error Reporting. This technique can be used to disable software such as antivirus leaving systems more vulnerable to malicious activity. Other security researchers have attempted to recreate the vulnerability and have found it difficult to do so in a reliable manner.