Description
The thread termination routine in the kernel for Windows NT 4.0 and 2000 (NTOSKRNL.EXE) allows local users to modify kernel memory and execution flow via steps in which a terminating thread causes Asynchronous Procedure Call (APC) entries to free the wrong data, aka the "Windows Kernel Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Microsoft Windows Server 2000 Kernel - APC Data-Free Local Escalation (MS05-055) EDB-1407 · local · Jan 5, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 18064 third-party-advisory
- ADV-2005-2868 vdb-entry
- 15826 vdb-entry
- MS05-055 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2005-234.pdf
- ADV-2005-2909 vdb-entry
- win-apc-gain-privileges(23447) vdb-entry
- 18311 third-party-advisory
- oval:org.mitre.oval:def:1583 vdb-entry signature
- EEYEB-20051213 third-party-advisory
- 252 third-party-advisory
- 20051213 [EEYEB-20050523] Windows Kernel APC Data-Free Local Privilege Escalation Vulnerability mailing-list
- 1015347 vdb-entry
- 18823 vdb-entry
- http://www130.nortelnetworks.com/cgi-bin/eserv/cs/main.jsp?cscat=BLTNDETAIL&DocumentOID=375420
- 15821 third-party-advisory