Microsoft finds privilege escalation vulnerability in Huawei driver

Re:Microsoft finds privilege escalation vulnerability in Hua... by novaleaf on Wednesday April 03, 2019 @08:12PM (#19568320)

The microsoft article mentions that Windows Defender caught multiple machines performing kernel injections near the same time with this driver as the root cause. Meaning it was already being exploited.

This doesn't mean the actual flaw was malicious, but being actively exploited, it seems intent doesn't really matter.

[ Parent | on HN ]

Re:Microsoft finds privilege escalation vulnerability in Hua... by monocasa on Wednesday April 03, 2019 @08:15PM (#19568340)

I don't see anything saying this was being actively exploited; the non malicious use case would set off their scanners on all MateBooks running this driver.

[ Parent | on HN ]

Re:Microsoft finds privilege escalation vulnerability in Hua... by novaleaf on Thursday April 04, 2019 @09:43AM (#19572163)

from the article:

> While monitoring alerts related to kernel-mode attacks, one alert drew our attention:

>The alert process tree showed an abnormal memory allocation and execution in the context of services.exe by a kernel code. Investigating further, we found that an identical alert was fired on another machine around the same time.

This shows code injection taking place, via the exploited code. You are right that they don't mention what code was injected (probably they don't know)

[ Parent | on HN ]

Re:Microsoft finds privilege escalation vulnerability in Hua... by monocasa on Thursday April 04, 2019 @12:08PM (#19573965)

> via the exploited code

Their scanner doesn't show any exploitation happening, and they don't say that it does.

[ Parent | on HN ]

Re:Microsoft finds privilege escalation vulnerability in Hua... by novaleaf on Friday April 05, 2019 @09:58AM (#19582517)

I admit that I am reading into the line "abnormal memory allocation and execution" and thinking it's intentional.

You are right that they don't seem to know what code was being executed. Just that some code (be it real code or random garbage) was injected and executed.

[ Parent | on HN ]

Re:Microsoft finds privilege escalation vulnerability in Hua... by monocasa on Sunday April 07, 2019 @12:38PM (#19597941)

It's intentional; it's not "exploitation". It's really doing privilege deescalation of the shellcode.

They know the code it's running for the most part, it's the CreatProcessW stuff they talk about.

[ Parent | on HN ]