Vulnerability Disclosure: Researcher drops 3 Windows 10 0-days

On May 22 2019, security researcher SandboxEscaper dropped 3 Windows 10 0-days on their Github. Two of the 0-days are local privilege escalations (LPE) and one is a sandbox escape for IE11. US CERT/CC Vulnerability Analyst Will Dormann confirmed on Twitter that the LPEs worked on a fully patched Windows 10 machine. SandboxEscaper released 4 Windows 0-days last year without notifying Microsoft last year. As reported by ZDnet, the vulnerabilities released last year were weaponized as early as 3 weeks from the disclosure.

Recommendations

• Enable Cyber Attack Chatter rule and add relevant terms related to these vulnerabilities
• Patch your Windows systems as soon as Microsoft releases security updates

Details

There has been little information why SandboxEscaper released these vulnerabilities other than having gripes with Microsoft. The researcher started talking about the bugs on their personal blog on May 21, 2019, advertising them for no less than $60,000 each. Both LPEs abuse how Windows Task Scheduler parses Discretionary-Access-Control-Lists. The third vulnerability is in Internet Explorer 11. As of May 22, 2019, the Github repo is up.