Windows 10 Sandbox activation enables zero-day vulnerability

[silversurfer]

A reverse engineer discovered a new zero-day vulnerability in most Windows 10 editions, which allows creating files in restricted areas of the operating system.
 
Exploiting the flaw is trivial and attackers can use it to further their attack after initial infection of the target host, albeit it works only on machines with Hyper-V feature enabled.
 
Reverse engineer Jonas Lykkegaard posted last week a tweet showing how an unprivileged user can create an arbitrary file in ‘system32,’ a restricted folder holding vital files for Windows operating system and installed software. However, this works only if Hyper-V is already active, something that limits the range of targets since the option is disabled by default and is present in Windows 10 Pro, Enterprise, and Education. [...]
 
CERT/CC vulnerability analyst Will Dormann confirmed that the vulnerability exists and that exploiting it requires literally no effort from an attacker on the host.
The researcher told BleepingComputer that the vulnerable component is ‘storvsp.sys’ (Storage VSP - Virtualization Service Provider), a server-side Hyper-V component.

Read more: https://www.bleepingcomputer.com/news/se...erability/