CVE-2011-1225

Vulnerability

CVE-2011-1225 is a NULL pointer de-reference vulnerability in the win32k.sys kernel-mode driver in Microsoft Windows. It affects Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 [1][2]. The vulnerability occurs when the kernel-mode driver improperly handles a pointer to a kernel-mode driver object, leading to a NULL pointer dereference when processing a specially crafted application [1]. This is distinct from other "Vulnerability Type 2" CVEs addressed in MS11-034 [1][2].

Exploitation

An attacker must have valid logon credentials and be able to log on locally to the target system [1][3]. The attacker then runs a specially crafted application that triggers the NULL pointer dereference in win32k.sys [1]. No remote exploitation or anonymous user access is possible [1]. The exploitation requires no user interaction beyond the attacker locally executing the malicious application.

Impact

Successful exploitation allows the attacker to gain elevated privileges on the affected system [1][3]. This can lead to complete compromise of the system, including the ability to execute arbitrary code in kernel mode, install programs, and view, change, or delete data [1]. The attacker achieves the same privilege level as the kernel, effectively gaining full control over the operating system.

Mitigation

Microsoft addressed this vulnerability in Security Bulletin MS11-034, released on April 12, 2011 [1]. The security update is rated Important for all supported releases of Microsoft Windows and corrects the way the kernel-mode drivers manage pointers to kernel-mode driver objects [1]. Customers with automatic updating enabled will receive the update automatically [1]. Avaya also recommends customers install the security update via Microsoft Windows Update [2]. No workarounds are documented, and manual installation via Microsoft Update or Windows Server Update Services (WSUS) is recommended for enterprise environments [1][3].