Multiple vulnerabilities in Windows kernel drivers

1) Out-of-bounds read

EUVDB-ID: #VU18172

Risk: Low

CVSSv3.1: 4.9 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0848

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition due to the way the win32k component provides kernel information. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Windows: 7 - 10 1809

Windows Server: 2008 - 2019 1803

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0848

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU18171

Risk: Low

CVSSv3.1: 4.9 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0814

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition due to the way the win32k component provides kernel information. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Windows Server: 2016 - 2019 1803

Windows: 10 1607 - 10 1809

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0814

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU18170

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0844

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition due to the way the Windows kernel handles objects in memory. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Windows: 7 - 10 1809

Windows Server: 2008 - 2019 1803

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0844

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU18169

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0840

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition due to the way the Windows kernel handles objects in memory. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Windows: 10 1709 - 10 1809

Windows Server: 2019 - 2019 1803

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0840

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU18168

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0685

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Windows Server: 2016 - 2019 1803

Windows: 10 1607 - 10 1809

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0685

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18166

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0805

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows handles calls to the LUAFV driver (luafv.sys). A local user can create a malicious application, launch it on the system and run arbitrary code in the security context of the local system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Windows: 7 - 10 1809

Windows Server: 2008 - 2019 1803

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0805

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18165

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0836

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows handles calls to the LUAFV driver (luafv.sys). A local user can create a malicious application, launch it on the system and run arbitrary code in the security context of the local system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Windows: 7 - 10 1809

Windows Server: 2008 - 2019 1803

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0836

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18164

Risk: Low

CVSSv3.1: 5.5 [CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0796

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows handles calls to the LUAFV driver (luafv.sys). A local privileged user can set the short name of a file with a long name to an arbitrary short name and overwrite files on the system with limited privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Windows: 7 - 10 1809

Windows Server: 2008 - 2019 1803

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0796

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18162

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0731

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows handles calls to the LUAFV driver (luafv.sys). A local user can create a malicious application, launch it on the system and execute arbitrary code in the security context of local system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Windows: 7 - 10 1809

Windows Server: 2008 - 2019 1803

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0731

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18161

Risk: Low

CVSSv3.1: 6 [CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-0730

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows handles calls to the LUAFV driver (luafv.sys). A local user can create a malicious application, launch it on the system and execute arbitrary code in the security context of local system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Windows: 7 - 10 1809

Windows Server: 2008 - 2019 1803

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0730

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

11) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18221

Risk: Low

CVSSv3.1: 3.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0732

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an error when processing calls to LUAFV driver (luafv.sys). A local user can circumvent a User Mode Code Integrity (UMCI) policy on the machine and bypass Device Guard protection.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 7 - 10 1809

Windows Server: 2008 - 2019 1803

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0732

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.