Google, Microsoft work together for a year to figure out new type of Windows flaw

guest · Mar 18, 2019

Google, Microsoft work together for a year to figure out new type of Windows flaw
Researcher finds building blocks for privilege escalation: Can they be assembled to create a flaw?
March 18, 2019
https://arstechnica.com/gadgets/201...or-12-months-to-find-new-kind-of-windows-bug/

One of the more notable features of Google Project Zero's (GPZ) security research has been its 90-day disclosure policy. In general, vendors are given 90 days to address issues found by GPZ, after which the flaws will be publicly disclosed.

Google researcher James Forshaw first grasped that there might be a problem a couple of years ago when he was investigating the exploitability of another Windows issue published three years ago. In so doing, he discovered the complicated way in which Windows performs permissions checks when opening files or other secured objects.
[...] At this point, he reached out to Microsoft to see if the company would be able to find any vulnerable pairings.
Click to expand...

Project Zero: Windows Kernel Logic Bug Class: Access Mode Mismatch in IO Manager

This blog discusses how I discovered the bug class and the technical background. For more information about the further investigation, fixing and avoiding writing new code with the bug class refer to MSRC’s blog post.
Click to expand...

Log in or Sign up

Google, Microsoft work together for a year to figure out new type of Windows flaw

guest Guest

Log in or Sign up

Google, Microsoft work together for a year to figure out new type of Windows flaw

guest Guest

Useful Searches