CVE-2007-1206

Vulnerability

The Windows Kernel's Virtual DOS Machine (VDM) in Windows NT 4.0, 2000 SP4, XP SP2, Server 2003 (all SP versions), and Vista before June 2006 uses PAGE_READWRITE permissions for a physical memory view [1]. This insecure permission setting allows a local user to modify the "zero page" during a race condition before the view is unmapped, leading to an elevation of privilege vulnerability [2].

Exploitation

An attacker must have local access and be able to run a specially crafted application [1]. The exploit relies on a race condition where the attacker modifies the zero page between the time the kernel maps the memory view with insecure permissions and the time it unmaps that view [2]. This requires precise timing and the ability to execute code on the target system.

Impact

Successful exploitation allows a local, authenticated attacker to execute arbitrary code with elevated privileges, potentially gaining complete control of the affected system [1]. The attacker could then install programs, view/change/delete data, or create new accounts with full user rights [1]. The compromised privilege level is kernel or system, bypassing normal user restrictions.

Mitigation

Microsoft released security update MS07-022 to address this vulnerability on April 10, 2007 [1]. Affected systems should apply the update at the earliest opportunity [2]. No workarounds are documented; the the only official mitigation is installing the update provided in MS07-022 [1].