CVE-2013-3660
Published: 24 May 2013
Summary
CVE-2013-3660 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is a memory corruption issue in the EPATHOBJ::pprFlattenRec function within win32k.sys, part of the kernel-mode drivers on Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012. It stems from improper initialization of a pointer for the next object in a list, which can be abused to obtain write access to the PATHRECORD chain. The flaw is tracked as CWE-119 and carries a CVSS score of 7.8.
Local users can exploit the issue without authentication by first forcing excessive consumption of paged memory and then issuing repeated FlattenPath function calls. Successful exploitation grants the attacker write access that leads to elevated privileges on the affected system.
Public references, including full-disclosure mailing-list posts and contemporaneous tweets, indicate the vulnerability received rapid attention from the security community shortly after publication, consistent with the availability of working proof-of-concept material. No official mitigation details are supplied in the CVE record itself.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2013-3593
Vulnerability details
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does…
more
not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."
- CWE(s)
- KEV Date Added
- 28 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of security-relevant patches that eliminate the EPATHOBJ pointer flaw in win32k.sys.
Enforces hardware or software memory-protection mechanisms that block the unauthorized writes to the PATHRECORD chain.
Limits initial privileges of local accounts so that successful exploitation yields fewer elevated rights on the system.