Windows 0-Day Dropped By Disgruntled Researcher Hands Hackers System Rights

An anonymous reader quotes a report from Ars Technica: Nightmare Eclipse, the pseudonym of a researcher with an ongoing, very public beef with Microsoft, has dropped yet another Windows zero-day. On Tuesday, Nightmare Eclipse disclosed SignDrop, a vulnerability that gives local users full System rights on some versions of Windows. The vulnerability resides in the Common Log File System, which Microsoft describes as a "general-purpose logging service used by software clients running in user-mode or kernel-mode." By forcing a privileged process such as Windows Defender to open a crafted CLFS container, an attacker with ordinary user rights can abuse the privileged file creation to elevate privileges to System. [...] Researcher Will Dormann said in an interview that he has been able to reproduce the exploit and that it works as described, but not on all versions of Windows 11. But there's a catch, he said. "The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems," he explained. "That is, you can't just take a new 26H2 system and install updates and have it work." For a system to be vulnerable, Dormann said, the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Modevalue must be 0 or 1." Of the many machines Dormann uses, only a single one met this requirement. Microsoft said in a statement that it was investigating the vulnerability and had no evidence it was being exploited in the wild. The company also said Defender blocks potential exploitation attempts.

Read more of this story at Slashdot.