CVE-2016-0006

Vulnerability

The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles reparse points. This flaw, known as the "Windows Mount Point Elevation of Privilege Vulnerability," is addressed in MS16-008 [1]. The vulnerability is distinct from CVE-2016-0007 and arises from incorrect handling of mount point creation within the sandbox [1]. All affected software versions are listed as Important severity [1].

Exploitation

An attacker must first log on to an affected system and then run a specially crafted application [1]. The exploit bypasses previous mitigations for CVE-2015-2553 by abusing shadow object directories to create limited mount reparse points that function within a sandboxed context [2]. The attacker can override a dos device path (e.g., C: or GLOBALROOT) by placing a dummy object directory that shadows the GLOBAL?? directory, then set a reparse point pointing to an arbitrary location (e.g., \Device\NamedPipe\). When the shadow directory is released, the real target resolves to the original intended path, but the reparse point persists as long as the attacker's process exists [2]. The exploit requires the ability to create a named object directory, which is possible from most sandboxes except highly restrictive ones like a Chrome renderer [2].

Impact

Successful exploitation allows a local attacker to elevate privileges on the system, gaining greater access or capabilities beyond those intended by the sandbox [1]. The CIA impact is primarily integrity and availability, as the attacker can compromise system processes and potentially execute arbitrary code with elevated privileges [1]. The sandbox bypass can lead to full system compromise if chained with other vulnerabilities [2].

Mitigation

Microsoft released security update MS16-008 (KB3124605) on January 12, 2016, which corrects how Windows handles certain scenarios involving mount point creation [1]. All affected versions of Windows should apply this update immediately. No workarounds are documented for versions that have not yet been patched; for unsupported or end-of-life systems, upgrading to a supported release is the only mitigation [1]. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.