Privilege escalation in Microsoft Windows and Windows Server - CVE-2016-7255

Vulnerability details

The vulnerability allows a local user to gain elevated privileges on the target system.

The weakness is due to improper handling of objects in memory by win32k.sys. By sending a specially crafted system call NtSetWindowLongPtr(), a local attacker can set index GWLP_ID to WS_CHILD value on a window handle with GWL_STYLE and execute arbitrary code with system privileges.

Successful explotation of the vulnerability results in privilege escalation.

Note: this vulnerability is being actively exploited in the wild.

Affected software

How to mitigate CVE-2016-7255

Links to Public Exploits and PoC-codes

• Exploit #6077 - Microsoft Windows - 'Win32k' Local Privilege Escalation (June 17, 2021)
• Exploit #3528 - CVE-2020-1054 () (July 20, 2020)
• Exploit #2796 - WindowsExploitationResources (Resources pertaining to advanced Windows exploit development and semi-related topics) (June 2, 2020)
• Exploit #2331 - CVE-2016-7255 (An exploit for CVE-2016-7255 on Windows 7/8/8.1/10(pre-anniversary) 64 bit) (April 7, 2020)
• Exploit #1956 - page-table-exploitation (A demonstration of how page tables can be used to run arbitrary code in ring-0 and lead to a privesc. Uses CVE-2016-7255 as an example.) (March 18, 2020)
• Exploit #453 - Microsoft Windows Kernel - 'win32k.sys' 'NtSetWindowLongPtr' Privilege Escalation (MS16-135) (2) (March 18, 2020)
• Exploit #454 - Microsoft Windows Kernel - 'win32k.sys' 'NtSetWindowLongPtr' Privilege Escalation (MS16-135) (1) (March 18, 2020)
• Exploit #455 - Microsoft Windows Kernel - win32k Denial of Service (MS16-135) (March 18, 2020)

External References

• https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html
• https://technet.microsoft.com/library/security/MS16-135

Related Security Bulletins

• Privilege escalation in Windows 10
• Multiple vulnerabilities in Microsoft Windows
• Win32k Elevation of Privilege Vulnerability