Windows 10 bug: Google again reveals code for 'important' unpatched flaw

[RV_]

Hoo boy, here we go again

 

Excerpt:

"Google's Project Zero has revealed another unpatched flaw affecting Windows 10 because Microsoft missed its 90-day deadline to patch or disclose.

After last week revealing a Windows 10 exploit mitigation bypass that Microsoft couldn't fix in time, Google on Tuesday revealed another security issue in Windows 10 -- this time one that Microsoft appeared to have fixed in February's Patch Tuesday but didn't, according to Project Zero researcher James Forshaw.

Forshaw in November reported to Microsoft a pair of bugs affecting the same function in Windows 10. The bugs are labeled by Google as issue 1427 and issue 1428, which include proof-of-concept code that demonstrates the flaw.

The bug was assigned the ID CVE-2018-0826, which Microsoft addressed this month, rating it as 'important' and 'more likely' to be exploited.

"An elevation of privilege vulnerability exists when Storage Services improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context," wrote Microsoft.

"To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system."

However, according to Forshaw, Microsoft's patch only resolved issue 1427, despite his having filed two reports to ensure this "edge case" described in issue 1428 wasn't missed.

"Note this is a second bug in the same function. I'm submitting it separately just to ensure that the resulting fix doesn't miss this edge case as well," Forshaw wrote in November."

Much more here with related links:

http://www.zdnet.com/article/windows-10-bug-google-again-reveals-code-for-important-unpatched-flaw/?loc=newsletter_small_thumb&ftag=TREc64629f&bhid=19724681974700635514865380622813