github - ghsa-f2wh-c6mm-3vrx

ghsa-f2wh-c6mm-3vrx

Vulnerability from github

Published

2022-05-14 01:31

Modified

2024-07-09 18:30

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2013-3660"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-05-24T20:55:00Z",
    "severity": "MODERATE"
  },
  "details": "The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka \"Win32k Read AV Vulnerability.\"",
  "id": "GHSA-f2wh-c6mm-3vrx",
  "modified": "2024-07-09T18:30:41Z",
  "published": "2022-05-14T01:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-3660"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/53435"
    },
    {
      "type": "WEB",
      "url": "http://twitter.com/taviso/statuses/309157606247768064"
    },
    {
      "type": "WEB",
      "url": "http://twitter.com/taviso/statuses/335557286657400832"
    },
    {
      "type": "WEB",
      "url": "http://www.computerworld.com/s/article/9239477"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/25611"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/93539"
    },
    {
      "type": "WEB",
      "url": "http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability"
    },
    {
      "type": "WEB",
      "url": "http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/ncas/alerts/TA13-190A"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2013-3660

Vulnerability from cvelistv5

Published

2013-05-24 20:00

Modified

2024-08-06 16:14

Severity ?

Summary

References

▼	URL	Tags
	http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html	mailing-list, x_refsource_FULLDISC
	http://www.exploit-db.com/exploits/25611/	exploit, x_refsource_EXPLOIT-DB
	http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html	mailing-list, x_refsource_FULLDISC
	http://secunia.com/advisories/53435	third-party-advisory, x_refsource_SECUNIA
	http://www.osvdb.org/93539	vdb-entry, x_refsource_OSVDB
	http://twitter.com/taviso/statuses/309157606247768064	x_refsource_MISC
	http://www.computerworld.com/s/article/9239477	x_refsource_MISC
	http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw	x_refsource_MISC
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360	vdb-entry, signature, x_refsource_OVAL
	http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/	x_refsource_MISC
	http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html	mailing-list, x_refsource_FULLDISC
	http://www.us-cert.gov/ncas/alerts/TA13-190A	third-party-advisory, x_refsource_CERT
	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053	vendor-advisory, x_refsource_MS
	http://twitter.com/taviso/statuses/335557286657400832	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:14:56.681Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20130517 Re: exploitation ideas under memory pressure",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html"
          },
          {
            "name": "25611",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "http://www.exploit-db.com/exploits/25611/"
          },
          {
            "name": "20130517 exploitation ideas under memory pressure",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html"
          },
          {
            "name": "53435",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/53435"
          },
          {
            "name": "93539",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/93539"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://twitter.com/taviso/statuses/309157606247768064"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.computerworld.com/s/article/9239477"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw"
          },
          {
            "name": "oval:org.mitre.oval:def:17360",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/"
          },
          {
            "name": "20130603 Re: exploitation ideas under memory pressure",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html"
          },
          {
            "name": "TA13-190A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/ncas/alerts/TA13-190A"
          },
          {
            "name": "MS13-053",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://twitter.com/taviso/statuses/335557286657400832"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-03-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka \"Win32k Read AV Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-12T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20130517 Re: exploitation ideas under memory pressure",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html"
        },
        {
          "name": "25611",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "http://www.exploit-db.com/exploits/25611/"
        },
        {
          "name": "20130517 exploitation ideas under memory pressure",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html"
        },
        {
          "name": "53435",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/53435"
        },
        {
          "name": "93539",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/93539"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://twitter.com/taviso/statuses/309157606247768064"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.computerworld.com/s/article/9239477"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw"
        },
        {
          "name": "oval:org.mitre.oval:def:17360",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/"
        },
        {
          "name": "20130603 Re: exploitation ideas under memory pressure",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html"
        },
        {
          "name": "TA13-190A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/ncas/alerts/TA13-190A"
        },
        {
          "name": "MS13-053",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://twitter.com/taviso/statuses/335557286657400832"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2013-3660",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka \"Win32k Read AV Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20130517 Re: exploitation ideas under memory pressure",
              "refsource": "FULLDISC",
              "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html"
            },
            {
              "name": "25611",
              "refsource": "EXPLOIT-DB",
              "url": "http://www.exploit-db.com/exploits/25611/"
            },
            {
              "name": "20130517 exploitation ideas under memory pressure",
              "refsource": "FULLDISC",
              "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html"
            },
            {
              "name": "53435",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/53435"
            },
            {
              "name": "93539",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/93539"
            },
            {
              "name": "http://twitter.com/taviso/statuses/309157606247768064",
              "refsource": "MISC",
              "url": "http://twitter.com/taviso/statuses/309157606247768064"
            },
            {
              "name": "http://www.computerworld.com/s/article/9239477",
              "refsource": "MISC",
              "url": "http://www.computerworld.com/s/article/9239477"
            },
            {
              "name": "http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw",
              "refsource": "MISC",
              "url": "http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw"
            },
            {
              "name": "oval:org.mitre.oval:def:17360",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360"
            },
            {
              "name": "http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/",
              "refsource": "MISC",
              "url": "http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/"
            },
            {
              "name": "20130603 Re: exploitation ideas under memory pressure",
              "refsource": "FULLDISC",
              "url": "http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html"
            },
            {
              "name": "TA13-190A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/ncas/alerts/TA13-190A"
            },
            {
              "name": "MS13-053",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053"
            },
            {
              "name": "http://twitter.com/taviso/statuses/335557286657400832",
              "refsource": "MISC",
              "url": "http://twitter.com/taviso/statuses/335557286657400832"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2013-3660",
    "datePublished": "2013-05-24T20:00:00",
    "dateReserved": "2013-05-24T00:00:00",
    "dateUpdated": "2024-08-06T16:14:56.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted