CVE-2015-2360
Published: 10 June 2015
Summary
CVE-2015-2360 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 2.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
win32k.sys in the kernel-mode drivers is affected by a memory corruption vulnerability in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1. The flaw, tracked as CVE-2015-2360 and also known as the Win32k Elevation of Privilege Vulnerability, is associated with CWE-119 and CWE-416 and can be triggered by a crafted application to produce memory corruption.
Local users can exploit the issue through a malicious application to either escalate privileges or trigger a denial of service. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability when the conditions for exploitation are met.
Microsoft addressed the vulnerability in security bulletin MS15-061, which provides patches for the affected platforms listed in the advisory.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2015-2453
Vulnerability details
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT…
more
Gold and 8.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
- CWE(s)
- KEV Date Added
- 25 May 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the vendor patch (MS15-061) that eliminates the win32k.sys memory-corruption flaw.
Enforces memory-protection mechanisms that block the corruption and use-after-free conditions exploited by the crafted application.
Restricts process privileges so that even a successful local exploit cannot obtain full administrative rights.