Kaspersky Threats

KLA10985
Privilege escalation vulnerabilities in Windows kernel-mode drivers

Updated: 06/18/2020

Detect date ?	03/14/2017
Severity ?	Critical
Description	Multiple cases of improper handling of objects in memory have been found in the Windows kernel-mode (Win32k) driver. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited remotely via a specially designed application by an attacker who has already logged on to the system.
Affected products	Windows Vista Service Pack 2 Windows 7 Service Pack 1 Windows 8.1 Windows RT Windows 10 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	MS17-018 CVE-2017-0056 CVE-2017-0024 CVE-2017-0026 CVE-2017-0078 CVE-2017-0079 CVE-2017-0080 CVE-2017-0081 CVE-2017-0082
Impacts ?	ACE [?] OSI [?] DoS [?] SB [?] PE [?]
Related products	Microsoft Windows Vista Microsoft Windows Server 2012 Microsoft Windows 7 Microsoft Windows Server 2008 Windows RT Microsoft Windows 10
CVE-IDS ?	CVE-2017-00567.2High CVE-2017-00247.2High CVE-2017-00267.2High CVE-2017-00787.2High CVE-2017-00797.2High CVE-2017-00807.2High CVE-2017-00817.2High CVE-2017-00827.2High
Microsoft official advisories	Microsoft Security Update Guide
KB list	4012217 4012215 4012216 4012606 4013198 4013429 4012212 4012214 4012213 4012497 4013083
Exploitation	Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.