Jan Vojtěšek

An elevation of privilege issue exists in the Windows kernel, specifically within the AppLocker driver `appid.sys`. The flaw stems from an exposed IOCTL (Input/Output Control) with insufficient access control, which allows an attacker with Administrator privileges to cross the boundary into the kernel. By abusing an untrusted pointer exposed through a kernel IOCTL, an attacker can call a user-controlled function pointer in kernel mode. Specifically, the exploit can use `ExpProfileDelete()` as a target to decrement `PreviousMode` from 1 to 0, causing `NtWriteVirtualMemory()` and `NtReadVirtualMemory()` to bypass security checks. This enables the manipulation of process tokens to obtain full SYSTEM privileges, even on systems with HVCI (Hypervisor-Protected Code Integrity) enabled. This issue has been exploited in the wild as a zero-day by the Lazarus group and has been utilized by the Mallox ransomware family and the BlackCat/ALPHV group.

The issue is related to an elevation-of-privilege vulnerability in the Win32k component of Windows operating systems. This vulnerability is associated with errors in processing objects in memory. Exploitation of this vulnerability can allow an attacker to elevate their privileges. The vulnerability can be exploited by opening a specially crafted RTF file, which can lead to local privilege escalation (LPE) to system level. There have been reports of this vulnerability being actively exploited in the wild.

An elevation of privilege issue exists in the Windows kernel Advanced Local Procedure Call (ALPC) subsystem. The flaw is caused by a use-after-free condition where an ALPC message retains a pointer to a thread, known as `WaitingThread`, after the thread has been freed. This creates a dangling pointer that the kernel may later dereference, potentially allowing an attacker to execute arbitrary code with SYSTEM privileges. This issue has been exploited in the wild to facilitate sandbox escapes from the Chromium browser.

The issue is related to a type confusion in the V8 engine of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This is described as a high severity issue. The vulnerability was discovered by researchers at Avast and reported to the developer on October 25. It is noted that this is the seventh 0-day vulnerability in Chrome fixed by Google this year, and the second attributed to Avast. There is no information provided about the estimated number of potentially affected devices worldwide or specific details about real-world incidents where this issue was exploited, beyond it being actively exploited.