CVE-2015-0010

Vulnerability

The CryptProtectMemory function in cng.sys (the Cryptography Next Generation driver) in Windows kernel-mode drivers does not check the impersonation token's level when the CRYPTPROTECTMEMORY_SAME_LOGON option is used. This affects Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 [1].

Exploitation

An attacker must be a local user and leverage a service that (1) has a named-pipe planting vulnerability or (2) uses world-readable shared memory for encrypted data. By exploiting these conditions, the attacker can call CryptProtectMemory with the CRYPTPROTECTMEMORY_SAME_LOGON option and bypass decryption restrictions, as the function does not verify the impersonation level [1].

Impact

Successful exploitation allows a local attacker to decrypt data that was encrypted using the CRYPTPROTECTMEMORY_SAME_LOGON option, thereby bypassing the intended security feature. This is a security feature bypass vulnerability (MSRC ID 20707) that could lead to information disclosure [1].

Mitigation

Microsoft released security update MS15-010 (KB3036220) on February 10, 2015, which addresses the vulnerability by correcting the impersonation level check in CryptProtectMemory. Users should apply the update to mitigate the risk. No workaround is documented [1].