Researchers at 0patch released a temporary micropatch for the unpatched BearLPE local privilege escalation zero-day flaw in Windows 10.

Experts at 0patch released a micropatch to temporary fix a still-unpatched local privilege escalation on systems without rebooting them.

The zero-day vulnerability, dubbed BearLPE, was recently disclosed by the security researcher SandboxEscaper.

We have issued a micropatch for one of SandboxEscaper's recent 0days (#BearLPE). It's free for home and educational use. Existing 0patch users had it automatically applied on their computers, others are welcome to create an account and install our agent. https://t.co/4Ny1jwdxPQ pic.twitter.com/gvWTpVM52f — 0patch (@0patch) May 31, 2019

The following video shows how the micropatch , composed of just five instructions, works on a vulnerable machine:

The exploit published by the expert triggers the flaw that resides in the Task Scheduler of Windows 10.

SandboxEscaper discovered that even starting with limited privileges it is possible to get SYSTEM rights by invoking a specific function. SandboxEscaper published a video PoC of the Windows zero-day that shows how to trigger it on Windows x86.

Will Dormann, vulnerability analyst at CERT/CC, confirmed that the Windows zero-day works on a fully patched (May 2019) Windows 10 x86 system.

According to Will Dormann, a vulnerability analyst at CERT/CC, the exploit is 100% reliable on x86 systems and needs to be recompiled for x64 machines.

I can confirm that this works as-is on a fully patched (May 2019) Windows 10 x86 system. A file that is formerly under full control by only SYSTEM and TrustedInstaller is now under full control by a limited Windows user.

Works quickly, and 100% of the time in my testing. pic.twitter.com/5C73UzRqQk — Will Dormann (@wdormann) May 21, 2019

“When you run Windows XP schtasks.exe on Windows 10, legacy RPC functions are called – which in turn call the current ones, such as SchRpcSetSecurity,” explained 0patch co-founder Mitja Kolsek.ù

The micropatch prevents changing the set of permissions a normal user has over a system file.



If you appreciate my effort in spreading cybersecurity awareness, please vote for Security Affairs in the section “Your Vote for the Best EU Security Tweeter”

Thank you

Pierluigi Paganini

( SecurityAffairs – micropatch , BearLPE)





Share this...

Linkedin Reddit Pinterest

Share On