Another Windows zero-day vulnerability revealed by Google

• The security vulnerability is said to affect Windows 7 systems particularly those with the 32-bit version.
• This flaw leads to a privilege escalation in the Windows kernel driver allowing malicious components to evade security sandbox.

Right after a Chrome security flaw was fixed by Google, another vulnerability existing in Microsoft’s Windows was disclosed by the tech giant.

According to Google’s Security Blog, the vulnerability could cause privilege escalation enabling attackers to bypass security sandboxes. The vulnerability was found to be affecting Windows 7 systems only.

Worth noting

• This Windows flaw only impacts Windows 7 32-bit systems because of the lack of exploit mitigations that are present in later versions.
• Local privilege escalation in win32k.sys kernel results in this flaw. As a result, attack instances can evade security sandboxes.
• Specifically, the flaw described by the blog is a ‘NULL pointer dereference in win32k!MNGetpItemFromIndex when NtUserMNDragOver() system call is called under specific circumstances.’
• Google has reported this flaw to Microsoft, which is yet to release a patch to fix the issue.

Why this matters – The blog also mentions that the Windows flaw can be leveraged for other attacks.

The Google Security blog pointed out that, “…we are publicly disclosing its existence because it is a serious vulnerability in Windows that we know was being actively exploited in targeted attacks. The unpatched Windows vulnerability can still be used to elevate privileges or combined with another browser vulnerability to evade security sandboxes.”

Since there are no workarounds, the only suggestible mitigation is upgrading to Windows 10, and keeping it updated with security patches whenever they are available.