CVE-2014-4113
Published: 15 October 2014
Summary
CVE-2014-4113 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability CVE-2014-4113 resides in win32k.sys within the kernel-mode drivers and affects Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1. It enables local privilege escalation when a crafted application is executed on the system.
Local users without administrative rights can exploit the flaw by running a malicious application, resulting in elevation to higher privileges. The issue carries a CVSS score of 7.8 and was actively exploited in the wild during October 2014.
Public references including Trend Micro analysis, Microsoft Security Research and Defense guidance, OSVDB, Packet Storm exploit code, and Secunia advisories address risk assessment and available updates for the Win32k.sys Elevation of Privilege Vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2014-4044
Vulnerability details
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1…
more
allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
- CWE(s)
- KEV Date Added
- 04 May 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the vendor patch that eliminates the win32k.sys EoP flaw before local exploitation can succeed.
Enforces least privilege so that even a successful local win32k.sys exploit yields minimal additional rights on the system.
Malicious-code protection mechanisms can block or alert on execution of the crafted application used to trigger the win32k.sys vulnerability.