Google"s Threat Analysis Group has released details about a Windows 10 vulnerability, leaving millions of users at risk, as Microsoft is yet to patch it.
This isn"t the first time that Google has made such information public prior to the availability of a fix, as it gives software makers a period of seven days to release a patch. Two years ago, the company reported about an unpatched Windows 8.1 security glitch and was later slammed by Microsoft for revealing details about another Windows 8.1 vulnerability before it was patched.
According to today"s report, the Windows 10 vulnerability is "particularly serious", as Google"s data has shown that it is being actively exploited. The details of the vulnerability are as follows:
The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD. Chrome"s sandbox blocks win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, which prevents exploitation of this sandbox escape vulnerability.
Microsoft has not yet published a security advisory or a patch ten days since it was privately disclosed by Google. However, the company had previously said that issues pertaining to the OS or other complex software cannot be fixed in the seven-day window that Google offers, before making details available to the public. This time around it could become a big problem for the software giant if it doesn"t act quickly.
Source: Google Security Blog via VentureBeat