CVE-2019-1215
HIGH KEV RANSOMWAREMicrosoft Windows 10 1507 - Improper Privilege Management
Title source: ruleExploitation Summary
CVE-2019-1215 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 3 public exploits from researchers including bluefrostsec, bluefrostsecurity, gavz.
AI-analyzed exploit summary This exploit leverages CVE-2019-1215, a Windows local privilege escalation vulnerability in the win32k.sys driver. It uses a race condition to corrupt kernel memory and execute shellcode in the context of winlogon.exe, achieving SYSTEM privileges.
Description
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.
Exploits (3)
This exploit leverages CVE-2019-1215, a Windows local privilege escalation vulnerability in the win32k.sys driver. It uses a race condition to corrupt kernel memory and execute shellcode in the context of winlogon.exe, achieving SYSTEM privileges.
This repository contains a functional exploit for CVE-2019-1215, a local privilege escalation vulnerability in the Windows ws2ifsl.sys driver. The exploit leverages a race condition to achieve arbitrary kernel write primitives, ultimately executing shellcode in the context of winlogon.exe to gain SYSTEM privileges.
This repository contains a functional exploit for CVE-2019-1215, a local privilege escalation vulnerability in the Windows ws2ifsl.sys driver. The exploit leverages a race condition to achieve arbitrary kernel memory writes, ultimately executing shellcode in the context of the winlogon.exe process to gain SYSTEM privileges.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H