CVE-2010-2743

Vulnerability

CVE-2010-2743 is an elevation of privilege vulnerability in the kernel-mode drivers (win32k.sys) of Microsoft Windows XP Service Pack 3. The vulnerability occurs because the Windows kernel-mode drivers do not properly perform indexing of a function-pointer table during the loading of keyboard layouts from disk [1]. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability; it cannot be exploited remotely or by anonymous users [1].

Exploitation

To exploit this vulnerability, a local attacker first logs on to an affected system and then runs a specially crafted application. The crafted application triggers the kernel-mode driver to incorrectly index the function-pointer table when loading a keyboard layout from disk [1]. This vulnerability was exploited in the wild in July 2010 by the Stuxnet worm [Description].

Impact

Successful exploitation allows an attacker to gain elevated privileges on the affected system [1]. The attacker could then run arbitrary code in kernel mode, install programs, view, change, or delete data, or create new accounts with full user rights [1].

Mitigation

Microsoft released security bulletin MS10-073 in October 2010 to address this vulnerability [1]. The update corrects the manner in which the Windows kernel-mode drivers index a table of function pointers when loading a keyboard layout from disk [1]. Customers with automatic updating enabled are automatically protected; others should install the update manually [1]. There is no known workaround or mitigation other than applying the security update.