Trusted Design

• 重大度: Unknown
• 公開日: 2013-05-24
• 更新日: 2025-10-22

概要

The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."

このCVEに関連するMITRE ATT&CKテクニック

• T1055.011 - Extra Window Memory Injection
• T1218.011 - Rundll32
• T1583.007 - Serverless
• T1003.002 - Security Account Manager
• T1583.002 - DNS Server
• T1114.001 - Local Email Collection
• T1484.002 - Trust Modification
• T1070.002 - Clear Linux or Mac System Logs
• T1598.003 - Spearphishing Link
• T1566.001 - Spearphishing Attachment
• T1003.007 - Proc Filesystem
• T1583.005 - Botnet
• T1103 - AppInit DLLs
• T1608.001 - Upload Malware
• T1558 - Steal or Forge Kerberos Tickets
• T1070.008 - Clear Mailbox Data
• T1050 - New Service
• T1518.002 - Backup Software Discovery
• T1182 - AppCert DLLs
• T1218.003 - CMSTP
• T1029 - Scheduled Transfer
• T1525 - Implant Internal Image
• T1547.005 - Security Support Provider
• T1181 - Extra Window Memory Injection
• T1145 - Private Keys
• T1555.003 - Credentials from Web Browsers
• T1535 - Unused/Unsupported Cloud Regions
• T1155 - AppleScript
• T1563 - Remote Service Session Hijacking
• T1177 - LSASS Driver
• T1055.013 - Process Doppelgänging
• T1546.008 - Accessibility Features
• T1027.017 - SVG Smuggling
• T1083 - File and Directory Discovery
• T1649 - Steal or Forge Authentication Certificates
• T1049 - System Network Connections Discovery
• T1051 - Shared Webroot
• T1584.005 - Botnet
• T1218.005 - Mshta
• T1608 - Stage Capabilities
• T1608.005 - Link Target
• T1598.002 - Spearphishing Attachment
• T1496.004 - Cloud Service Hijacking
• T1134.004 - Parent PID Spoofing
• T1055.014 - VDSO Hijacking
• T1071.002 - File Transfer Protocols
• T1679 - Selective Exclusion
• T1502 - Parent PID Spoofing
• T1574.013 - KernelCallbackTable
• T1219.003 - Remote Access Hardware
• T1562.001 - Disable or Modify Tools
• T1559 - Inter-Process Communication
• T1574 - Hijack Execution Flow
• T1078 - Valid Accounts
• T1055.012 - Process Hollowing
• T1068 - Exploitation for Privilege Escalation
• T1110.004 - Credential Stuffing
• T1187 - Forced Authentication
• T1218.010 - Regsvr32
• T1587.004 - Exploits
• T1036.003 - Rename Legitimate Utilities
• T1595.003 - Wordlist Scanning
• T1137.004 - Outlook Home Page
• T1553.004 - Install Root Certificate
• T1499 - Endpoint Denial of Service
• T1546.010 - AppInit DLLs
• T1588 - Obtain Capabilities
• T1500 - Compile After Delivery
• T1213.003 - Code Repositories
• T1223 - Compiled HTML File
• T1159 - Launch Agent
• T1538 - Cloud Service Dashboard
• T1055.008 - Ptrace System Calls
• T1653 - Power Settings
• T1137.002 - Office Test
• T1204.001 - Malicious Link
• T1547.008 - LSASS Driver
• T1055.001 - Dynamic-link Library Injection
• T1086 - PowerShell

このCVEが関連しているPulses

このCVEが関連しているPulsesはありません。

CVEの関係性グラフ

---

← CVE一覧に戻る