In May, Kaspersky (@oct0xor) discovered CVE-2020-0986 in windows splwow64 was exploited itw as a 0day. microsoft released a patch in June, but that patch didnt fix the vuln. After reporting that bad fix in Sept under a 90day deadline, it's still not fixed. https://t.co/WDGNs3JGka — Maddie Stone (@maddiestone) December 23, 2020
In May, Kaspersky (@oct0xor) discovered CVE-2020-0986 in windows splwow64 was exploited itw as a 0day. microsoft released a patch in June, but that patch didnt fix the vuln. After reporting that bad fix in Sept under a 90day deadline, it's still not fixed. https://t.co/WDGNs3JGka
The original issue was an arbitrary pointer dereference which allowed the attacker to control the src and dest pointers to a memcpy. The "fix" simply changed the pointers to offsets, which still allows control of the args to the memcpy. — Maddie Stone (@maddiestone) December 23, 2020
The original issue was an arbitrary pointer dereference which allowed the attacker to control the src and dest pointers to a memcpy. The "fix" simply changed the pointers to offsets, which still allows control of the args to the memcpy.