CVE-2015-6175
Published: 09 December 2015
Summary
CVE-2015-6175 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 10.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is a Windows kernel memory corruption issue tracked as CVE-2015-6175 that affects the kernel component of Microsoft Windows 10 Gold (the initial release). It is described as an elevation-of-privilege flaw that can be triggered by a specially crafted application.
Local attackers who can run code on an affected system can exploit the flaw by supplying a malicious application. Successful exploitation grants the attacker elevated privileges, with the CVSS vector indicating high impact to confidentiality, integrity, and availability when the attack is launched locally with no special privileges required beyond user-level execution and some user interaction.
Microsoft addressed the issue in security bulletin MS15-135, which provides patches that remediate the kernel memory handling defect. The bulletin and associated SecurityTracker entries direct administrators to apply the updates to eliminate the vulnerability.
The flaw appears in the CISA Known Exploited Vulnerabilities catalog, confirming that it has been observed in real-world attacks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2015-6118
Vulnerability details
The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability."
- CWE(s)
- KEV Date Added
- 25 May 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the vendor patch (MS15-135) that eliminates the kernel memory corruption flaw.
Mandates memory-protection mechanisms (DEP, ASLR, etc.) that block the kernel memory corruption technique used by the crafted application.
Enforces least-privilege execution so a local user account cannot easily reach the elevated privileges obtained after successful exploitation.