CVE-2013-3660
HIGH KEV RANSOMWAREWindows - Local Privilege Escalation via EPATHOBJ::pprFlattenRec Pointer Initialization
Title source: llmExploitation Summary
CVE-2013-3660 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 28, 2022, with confirmed use in ransomware campaigns.
EIP tracks 5 public exploits from researchers including Tavis Ormandy, ExploitCN, including a Metasploit module exploits/windows/local/ppr_flatten_rec.
AI-analyzed exploit summary This exploit leverages a race condition in the Windows kernel's EPATHOBJ::bFlatten function to achieve arbitrary memory writes, leading to a SYSTEM privilege escalation. The PoC uses a watchdog thread to patch a compromised linked list while the kernel is stuck in a loop, demonstrating a reliable LPE on Windows 8.
Description
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."
Exploits (5)
This exploit leverages a race condition in the Windows kernel's EPATHOBJ::bFlatten function to achieve arbitrary memory writes, leading to a SYSTEM privilege escalation. The PoC uses a watchdog thread to patch a compromised linked list while the kernel is stuck in a loop, demonstrating a reliable LPE on Windows 8.
This exploit targets a memory corruption vulnerability in the Windows kernel (win32k.sys) via the EPATHOBJ::pprFlattenRec function, allowing local privilege escalation by manipulating PATHRECORD structures through crafted PolyDraw operations.
This Metasploit module exploits a local privilege escalation vulnerability in Windows (CVE-2013-3660) by corrupting memory via uninitialized data in EPATHOBJ::pprFlattenRec. It migrates to a new process, loads an exploit DLL, and escalates privileges to SYSTEM.
This Metasploit module exploits a memory corruption vulnerability in EPATHOBJ::pprFlattenRec due to uninitialized data usage, allowing local privilege escalation on vulnerable Windows systems. It checks the target system's win32k.sys version for vulnerability and reflectively injects a DLL payload to trigger the exploit.
References (15)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H