Raising the Dead
Summary: Project Zero's James Forshaw described a Windows elevation-of-privilege flaw in NtCreateLowBoxToken, the Windows 8 system call behind AppContainer and IE11 Enhanced Protected Mode tokens, which Microsoft fixed in bulletin MS15-111. The kernel captured user-supplied handles without checking their object type, letting a thread's impersonation token reference the thread itself and keep a terminated process's kernel object alive after logout on multi-user systems such as Terminal Servers.
Why it matters: Microsoft initially wasn't sure the bug was more than a local denial of service, yet Forshaw showed it was an EoP - and the leftover process is invisible to Task Manager and Process Explorer and cannot be terminated because it is already terminated.
Read the original at Google Project Zero ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026