CVE-2016-0143

Vulnerability

The Win32k.sys kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 contains an elevation of privilege vulnerability (CVE-2016-0143). This bug, a different vulnerability than CVE-2016-0165 and CVE-2016-0167, can be triggered by a crafted application interacting with the kernel-mode driver [1].

Exploitation

An attacker must have local access to the system and be able to run a specially crafted application. The proof-of-concept triggered a null pointer read on 32-bit Windows 7 and writes to an unmapped memory region on 64-bit Windows 7 [2]. Exploitation requires no user interaction beyond running the malicious application.

Impact

Successful exploitation allows an attacker to execute code with elevated privileges, potentially gaining full control of the affected system. This could lead to installation of programs, viewing or modifying data, or creating new accounts with full user rights [1].

Mitigation

Microsoft released security update MS16-039 (KB3148522) on April 12, 2016, which addresses this vulnerability [1]. Affected users should apply the update immediately. No workarounds are provided in the reference; outdated versions without the patch remain vulnerable.