CVE-2011-1236

Vulnerability

A use-after-free vulnerability exists in the win32k.sys kernel-mode driver in Microsoft Windows. The flaw arises from incorrect driver object management, where the driver fails to properly track pointers to kernel-mode driver objects, leading to a use-after-free condition. Affected versions include Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 [1][2]. This vulnerability is one of thirty addressed in MS11-034 [1].

Exploitation

An attacker must have valid logon credentials and be able to log on locally to the target system. The attacker then runs a specially crafted application that triggers the use-after-free condition in the win32k.sys driver. No user interaction beyond local logon is required; the malicious application directly exploits the vulnerability [1][3].

Impact

Successful exploitation allows a local attacker to gain elevated privileges on the affected system. The attacker can execute arbitrary code in kernel mode, leading to complete compromise of the system's confidentiality, integrity, and availability [1][3].

Mitigation

Microsoft released security update MS11-034 (2506223) on April 12, 2011, which addresses this vulnerability by correcting the way kernel-mode drivers manage objects and track pointers [1]. The update is rated Important and is available via Windows Update. Avaya also recommends applying the update for affected products [2]. No workaround is provided; applying the update is the only mitigation.