Security restrictions bypass in Microsoft Edge - #VU10652
Published: February 19, 2018 / Updated: June 11, 2019
Vulnerability identifier: #VU10652
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Microsoft
Affected software:
Microsoft Edge
Microsoft Edge
Detailed vulnerability description
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The weakness exists in Arbitrary Code Guard (ACG) technology for Windows 10 Creators Update due to an error when data is writtent in the process of content during Just-in-time compilation. A remote attacker can compromise the content process that allows to predict on which address JIT process is going to call VirtualAllocEx() next, unmap the shared memory mapped above using UnmapViewOfFile(), allocate a writable memory region on the same address JIT server is going to write and write a soon-to-be-executable payload there and cause the memory protection to be set to PAGE_EXECUTE_READ when JIT process calls VirtualAllocEx().
The weakness exists in Arbitrary Code Guard (ACG) technology for Windows 10 Creators Update due to an error when data is writtent in the process of content during Just-in-time compilation. A remote attacker can compromise the content process that allows to predict on which address JIT process is going to call VirtualAllocEx() next, unmap the shared memory mapped above using UnmapViewOfFile(), allocate a writable memory region on the same address JIT server is going to write and write a soon-to-be-executable payload there and cause the memory protection to be set to PAGE_EXECUTE_READ when JIT process calls VirtualAllocEx().
Remediation
Install updates from vendor's website.