Vulners
Lucene search
Microsoft Windows 10 RS2 (x64) - 'win32kfull!bFill' Pool Overflow
| Reporter | Title | Published | Views | Family All 39 |
|---|---|---|---|---|
 | Microsoft Windows 10 x64 RS2 - win32kfull!bFill Pool Overflow Exploit | 6 Oct 201700:00 | – | zdt |
 | Exploit for Use After Free in Microsoft | 16 Oct 202116:17 | – | githubexploit |
| Exploit for Code Injection in Microsoft | 4 Jan 202615:28 | – | githubexploit |
| Exploit for Use After Free in Microsoft | 16 Oct 202116:17 | – | githubexploit |
| Exploit for Code Injection in Microsoft | 4 Jan 202615:28 | – | githubexploit |
| Exploit for CVE-2016-3309 | 6 Oct 201707:59 | – | githubexploit |
 | CVE-2016-3309 | 9 Aug 201600:00 | – | attackerkb |
| CVE-2016-3310 | 9 Aug 201600:00 | – | attackerkb |
| CVE-2016-3311 | 9 Aug 201600:00 | – | attackerkb |
 | CVE-2016-3309 | 6 Oct 201716:06 | – | circl |
10
Sources:
https://siberas.de/blog/2017/10/05/exploitation_case_study_wild_pool_overflow_CVE-2016-3309_reloaded.html
https://github.com/siberas/CVE-2016-3309_Reloaded
Exploits for the recently-patched win32kfull!bFill vulnerability. Executing the Palette or Bitmap exploit will give you SYSTEM privileges on the affected system. The exploits should work fine on Windows 10 x64 with Creators Update, build 15063.540 (latest version of Win10 before the release of Microsoft's September Updates).
The Visual Studio solution contains three exploits:
CVE-2016-3309_Reloaded_Bitmaps: Exploit using the Bitmaps technique
CVE-2016-3309_Reloaded_Palettes: Exploit using the Palettes technique
CVE-2016-3309_Reloaded_Deadlock: POC exploit showcasing the system deadlock which happens due to improved Handle validation
We also published a blog post (https://siberas.de/blog/2017/10/05/exploitation_case_study_wild_pool_overflow_CVE-2016-3309_reloaded.html) which goes into detail about the exploitation of this "wild" Pool-based overflow.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42960.zip
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
06 Oct 2017 00:00Current
7.8High risk
Vulners AI Score7.8
CVSS 27.2
CVSS 3.17.8
EPSS0.43241
SSVC