Description
The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 3
- Microsoft Windows Kernel - 'win32k.sys NtSetWindowLongPtr' Local Privilege Escalation (MS16-135) (2) EDB-41015 · local · Jan 8, 2017
- Microsoft Windows Kernel - 'win32k.sys NtSetWindowLongPtr' Local Privilege Escalation (MS16-135) (1) EDB-40823 · local · Nov 24, 2016
- Microsoft Windows Kernel - 'win32k' Denial of Service (MS16-135) EDB-40745 · dos · Nov 9, 2016
GitHub 5 repositories
-
FSecureLABS/CVE-2016-7255 ★ 81 · Mar 2, 2017
An exploit for CVE-2016-7255 on Windows 7/8/8.1/10(pre-anniversary) 64 bit
-
yuvatia/page-table-exploitation ★ 11 · Jun 9, 2018
A demonstration of how page tables can be used to run arbitrary code in ring-0 and lead to a privesc. Uses CVE-2016-7255 as an example.
-
heh3/CVE-2016-7255 ★ 3 · Jan 13, 2017
-
bbolmin/cve-2016-7255_x86_x64 ★ 1 · Sep 13, 2018
porting CVE-2016-7255 to x86 for educational purposes.
-
homjxi0e/CVE-2016-7255 ★ 0 · Apr 15, 2017
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://packetstormsecurity.com/files/140468/Microsoft-Windows-Kernel-win32k.sys-NtSetWindowLongPtr-Privilege-Escalation.html
- https://github.com/mwrlabs/CVE-2016-7255
- 40823 exploit
- 41015 exploit
- https://securingtomorrow.mcafee.com/mcafee-labs/digging-windows-kernel-privilege-escalation-vulnerability-cve-2016-7255/
- 40745 exploit
- 1037251 vdb-entry
- MS16-135 vendor-advisory
- http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/
- 94064 vdb-entry
- https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html