Analysis of Microsoft's Critical 0day Vulnerability: Potential Threat to Web3 Security

Last month, Microsoft released a security patch that fixed a Windows kernel privilege escalation vulnerability being exploited by hackers. This vulnerability only affects earlier Windows systems, while Windows 11 seems unaffected. This article will analyze how attackers may continue to exploit this vulnerability in the context of increasingly strengthened security measures.

This 0day vulnerability may be maliciously exploited without detection after being discovered, posing significant destructive potential. Through this vulnerability, hackers can gain complete control of the Windows system. Being compromised may lead to serious consequences such as personal information leaks, system crashes, and financial losses. From a Web3 perspective, users' private keys may be stolen, digital assets may be transferred, and it could even impact the entire Web3 ecosystem based on Web2 infrastructure.

Analysis of the patch revealed that the issue lies in the reference count of an object being processed multiple times. win32k is older code, and from earlier comments, it can be seen that the previous code only locked the window object and did not lock the menu object within the window, which may lead to incorrect references to the menu object.

To trigger the vulnerability, we constructed a special multi-layer menu structure and removed certain reference relationships at key positions. This allows the target menu object to be successfully released when the kernel function returns to the user layer, making it invalid for subsequent references.

The overall idea of exploiting this vulnerability is to elevate privileges by modifying the token address through read and write primitives. The key is how to control the value of cbwndextra using the UAF vulnerability, and subsequently how to reliably achieve arbitrary read and write operations.

We have achieved stable read and write primitives through a carefully designed memory layout, utilizing window objects and HWNDClass objects. GetMenuBarInfo() is used for arbitrary read, and SetClassLongPtr() is used for arbitrary write. Except for token writing, other writes are implemented using the class object of the first window object through offsets.

Overall, the win32k vulnerability has a long history, but Microsoft is reconstructing the related code using Rust. The exploitation of such vulnerabilities mainly relies on the leakage of desktop heap handle addresses. If this issue is not thoroughly resolved, older systems will still be at risk. In the future, targeted detection of abnormal memory layouts and window data read/write operations may be one of the effective ways to discover such vulnerabilities.