Between a Rock and a Hard Link
Summary: Project Zero's James Forshaw described how NTFS hard links can serve as a privilege-escalation primitive, because the kernel's NtSetInformationFile requested no access rights on the target file for the FileLinkInformation class, letting a sandboxed process link to files it could not write to. He demonstrated it against the Mozilla Maintenance Service, which wrote its log to C:\ProgramData\Mozilla\logs, and Microsoft's MS15-115 update (CVE-2015-6113) added a check requiring FILE_WRITE_ATTRIBUTES when RtlIsSandboxedToken is true.
What you should know: The fix only covers sandboxed processes: Forshaw notes it would have done nothing for the Maintenance Service flaw, which stemmed from a user-writable log directory, so any privileged service writing to ProgramData or the Windows Temp folder remains a candidate for the same attack.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-4481
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026