A Shadow of our Former Self

Summary: Google Project Zero's James Forshaw described a technique using shadow object directories, introduced in Windows 8, to recover symbolic link capability inside sandboxes and exploit file planting or TOCTOU attacks. He used it against CVE-2016-3219, a race in Win32k's font path verification under the Custom Font Disable Mitigation Policy, and Microsoft blocked the trick in a sandbox with MS16-092 in the July updates.
Why it matters: The exploit let a sandboxed process pass the kernel's check on a system font path and then have it open a user-controlled font instead, defeating a mitigation meant to keep custom fonts out of the kernel; Microsoft's fix only stops a privileged application from following a shadow directory created under a sandbox token.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2016-3219
Related: Windows Kernel Logic Bug Class: Access Mode Mismatch in IO Manager Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026