Elevation of privilege in Microsoft Windows and Windows Server - CVE-2016-3309

Vulnerability details

The vulnerability allows a local user to gain elevated privileges on vulnerable system.

The vulnerability exists due to boundary error in Win32k.sys driver when handling objects in memory. A local user can trigger buffer overflow and execute arbitrary code with SYSTEM privileges.

Successful exploitation of this vulnerability will allow a local user to gain complete access to vulnerable system.

Affected software

How to mitigate CVE-2016-3309

Links to Public Exploits and PoC-codes

• Exploit #104 - CVE-2016-3309_Reloaded (Exploits for the win32kfull!bFill vulnerability on Win10 x64 RS2 using Bitmap or Palette techniques) (March 18, 2020)
• Exploit #383 - Microsoft Windows 10 RS2 (x64) - 'win32kfull!bFill' Pool Overflow (March 18, 2020)

External References

• https://technet.microsoft.com/en-us/library/security/ms16-098.aspx

Related Security Bulletins

• Multiple vulnerabilities in Windows Win32k.sys driver
• Win32k.sys EoP vulnerability
• Security Update for Windows Kernel-Mode Drivers