The story of CVE-2011-2018 exploitation

[Nytro]

The story of CVE-2011-2018 exploitation

Mateusz \j00ru" Jurczyk

February - April 2012

Abstract

Exploitation of Windows kernel vulnerabilities is recently drawing

more and more attention, as observed in both monthly Microsoft advi-

sories and technical talks presented on public security events. One of the

most recent security

aws xed in the Windows kernel was CVE-2011-

2018 1, a vulnerability which could potentially allow a local attacker to

execute arbitrary code with system privileges. The problem aected all

- and only - 32-bit editions of the Windows NT-family line, up to Win-

dows 8 Developer Preview 2. In this article, I present how certain novel

exploitation techniques can be used on dierent Windows platforms to

reach an elevation of privileges through this specic kernel vulnerability.

Download:

j00ru.vexillium.org/blog/20_05_12/cve_2011_2018.pdf