A vulnerability has been identified in Microsoft Windows, which could be exploited by local attackers to gain elevated privileges. This issue is caused due to the kernel not properly handling certain exceptions when setting up a VDM (Virtual DOS Machine) context, which allow malicious users to gain kernel privileges by setting up a specially crafted "VDM_TIB" in their "TEB" and reach the "Ki386BiosCallReturnAddress()" function via the #GP trap handler (nt!KiTrap0D).

VUPEN confirmed the vulnerability on fully patched Windows XP SP3 and Windows Server 2008 systems.

Affected Products

Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP Service Pack 2
Microsoft Windows XP Service Pack 3
Microsoft Windows Server 2003 Service Pack 2
Microsoft Windows Vista
Microsoft Windows Vista Service Pack 1
Microsoft Windows Vista Service Pack 2
Microsoft Windows Server 2008 (32-bit)
Microsoft Windows Server 2008 (32-bit) Service Pack 2
Microsoft Windows 7 (32-bit)

Solution

Apply patches :
http://www.microsoft.com/technet/security/bulletin/ms10-015.mspx

References

http://www.vupen.com/english/advisories/2010/0179
http://www.microsoft.com/technet/security/advisory/979682.mspx
http://www.microsoft.com/technet/security/bulletin/ms10-015.mspx

In-depth Binary Analysis

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Private Exploit or PoC

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Credits

Vulnerability reported by Tavis Ormandy.

Changelog

2010-01-20 : Initial release
2010-01-21 : MS 979682 Available
2010-02-09 : Updated Solution

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.