Analysis of Serious Vulnerabilities in Microsoft Windows System: Potential Security Risks to Web3 Infrastructure

Last month, Microsoft released a security patch that fixed a win32k privilege escalation vulnerability being exploited in the wild by hacker groups. This vulnerability primarily exists in older versions of Windows and cannot be triggered on Windows 11.

These types of win32k vulnerabilities have existed for a long time. This article will analyze how attackers may continue to exploit this vulnerability in the context of constantly improving security measures. We have conducted a comprehensive analysis in a Windows Server 2016 environment.

This 0day vulnerability is a serious flaw at the Windows system level, allowing hackers to gain complete control of the system. After an attack, it may lead to severe consequences such as personal information leakage, system crashes, data loss, financial losses, and malware implantation. From a Web3 perspective, users' private keys may be stolen, and digital assets may be transferred. More seriously, this vulnerability could threaten the entire Web3 ecosystem running on Web2 infrastructure.

Patch analysis shows that the issue lies in the reference count of an object being processed multiple times. According to earlier source code comments, previous code only locked the window object, without locking the menu object in the window, which led to the menu object potentially being referenced incorrectly.

To reproduce the vulnerability, we constructed a special multi-layer nested menu structure and set specific properties for each menu to pass the system checks. Ultimately, when the xxxRedrawTitle function returns to the user layer, the vulnerability is triggered by removing the reference relationships between the menus.

In terms of exploitation, we mainly considered two approaches: executing shellcode and using read-write primitives to modify the token. Considering some security mechanisms on the new system, we chose the latter. The entire exploitation process can be divided into two steps: first, controlling the value of cbwndextra using the UAF vulnerability, and then constructing stable read-write primitives based on this.

We achieve control over the target data by using a carefully designed memory layout, along with window objects and HWNDClass objects. Finally, we use the GetMenuBarInfo() and SetClassLongPtr() functions to realize arbitrary read and write.

Overall, although the win32k vulnerability has begun to be restructured with Rust in the Windows 11 preview version, it still poses a serious security risk for older systems. The exploitation process of this vulnerability is relatively simple and mainly relies on the leakage of desktop heap handle addresses. Future detection of such vulnerabilities can focus on abnormal memory layouts and unconventional read and write operations on window data.