Google project zero uncovers a serious security problem in windows 10

A few days ago, Google's Project Zero team exposed a security flaw in Microsoft Edge. This bug relates to the SvcMoveFileInheritSecurity remote procedure call (RPC), which if exploited can lead to an arbitrary file being assigned an arbitrary security descriptor, which can lead to elevation of privilege.

Microsoft faces serious security issue uncovered by Project Zero

The remote procedure call makes use of the MoveFileEx function call that moves a file to a new destination. The problem occurs when the RPC moves a linked file to a new directory that has inheritable access control entries (ACEs). Even if the linked file doesn't allow deletion, it can be allowed based on the permissions provided by the new home directory it has been moved to.

This means that even if the file is read-only, if the server calls SetNamedSecurityInfo in the parent directory, it will be able to assign an arbitrary security descriptor to it, potentially allowing other users on the network to modify it. The security researcher who discovered this problem has also attached a proof-of-concept code in C ++, which creates a text file in the Windows folder and abuses the SvcMoveFileInheritSecurity RPC to overwrite the security descriptor and allow access to everybody.

We recommend reading our post on Best processors on the market (February 2018)

Based on the details presented in the report, it was revealed to be a high-severity security issue for Microsoft on November 10, 2017, along with a similar 1427 security issue. The 90-day standard deadline was provided to resolve both issues, but given the impossibility, Microsoft requested an extension by the deadline and released the alleged solution last week.

However, contrary to what Microsoft may have believed, the patch fixed issue 1427, but detailed analysis by the Google researcher proves that the issue detailed above has not yet been resolved. Google has informed the Microsoft Security Response Center (MSRC) that it is making the error visible to the public.

It will be interesting to see if this revelation speeds up the correction of the error, since it is now public knowledge, even for those with malicious intent.

Neowin font