The last couple of weeks were marked by the flawed release of Windows 10 v1809 October Update. Microsoft was forced to pull the update due to a major bug in the final release.
Along with this problem, the company also had to solve other issues in Windows 10, like Zero-Day vulnerability. A zero-day flaw in Windows 10 was initially reported by Kaspersky back in August, who said that the flaw was exploited for targeted attacks in the Middle East.
In its release notes published last week, Microsoft gave more details regarding Elevation of Privilege Vulnerability (CVE-2018-8435).
“An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.
The update addresses this vulnerability by correcting how Win32k handles objects in memory.”
According to Kaspersky, the flaw has been used by the FruityArmor hacking group. Kaspersky also warned that the code of exploit is of high quality and aimed to reliably exploit as many Windows operating systems as possible.
Windows consumers are advised to install this update as soon as possible.