CVE-2016-7223

Vulnerability

The Virtual Hard Disk (VHD) driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 fails to properly restrict access to files [1]. This allows a local user to exploit the driver through a crafted application, leading to privilege escalation.

Exploitation

An attacker must have valid local user credentials and be able to execute a crafted application on the system. No additional user interaction is required; the application directly interacts with the VHD driver to manipulate files in restricted locations [1].

Impact

Successful exploitation grants the attacker elevated privileges, enabling them to read, write, or delete files that are normally restricted, potentially leading to full system compromise [1].

Mitigation

Microsoft released security update MS16-138 on November 8, 2016, which addresses this vulnerability by correcting how the kernel API restricts file access [1]. All affected Windows versions should apply this update.