TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln

Summary: Project Zero's Maddie Stone set out to root-cause CVE-2019-1458, a Win32k escalation-of-privilege flaw reported exploited in the wild and patched in December 2019, by binary patch-diffing Windows 7 win32k.sys because she could not obtain the exploit sample. After three work weeks from first VM setup to a working crash proof-of-concept, Microsoft's 24-hour blog preview revealed she had analyzed CVE-2019-1433, a different bug patched in November 2019, because her baseline VM stopped at September 2019 updates.
Why it matters: A researcher with deep reverse-engineering experience but no Windows background needed three work weeks to produce a crash POC from patch diffing alone, and the only thing that caught her targeting the wrong vulnerability was the vendor preview - a reminder that patch diffing hands whoever does it the bug details at the same moment defenders get the patch.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-1433 CVE-2019-1458
Related: CVE-2019-1458: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Jan 10, 2022
Microsoft Patch Tuesday — Dec. 2019: Vulnerability disclosures and Snort coverage Cyber Risks ·
Patch Tuesday, December 2019 Edition Cyber Risks ·