Scholarlink

The Windows operating system implements many access control techniques in order to ensure its integrity, confidentiality and availability. Despite these access control techniques, studies have shown that the Windows operating system is still vulnerable to improper privilege management. This cybersecurity research project delves into three elevation of privilege Common Vulnerabilities and Exposures (CVEs), namely CVE-2020-1170, CVE-2021-21551, and CVE-2023-21768. The objective is to scrutinise the effectiveness of the respective vendor's patching strategies, specifically examining whether patches comprehensively address the root cause of the vulnerabilities or merely mitigate specific methods of replication and exploitation. The methodology uses a combination of static analysis tools like Ghidra, IDA and BinDiff, as well as dynamic analysis tools like Process Monitor (ProcMon) and WinDbg. Each vulnerability was replicated on a virtual machine (VM) to conduct a detailed analysis of its impact on the operating system and its root cause. Next, we evaluated if their patches are sufficient at fully mitigating the root cause of the vulnerability. In our study of CVE-2020-1170 and CVE-2021-21551, we found that the patches do not completely mitigate the vulnerability as there are ways that attackers can bypass them. In contrast, we found that CVE-2023-21768 exhibits successful patching that prevents elevation of privileges. While vendors patch certain vulnerabilities effectively, our research emphasises the need for more comprehensive measures to ensure robust cybersecurity.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

What’s Under the Hood? Root Cause and Patch Analyses of Elevation of Privilege Vulnerabilities in the Windows Operating System

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Tze Bin Bryan Pak

摘要

The Windows operating system implements many access control techniques in order to ensure its integrity, confidentiality and availability. Despite these access control techniques, studies have shown that the Windows operating system is still vulnerable to improper privilege management. This cybersecurity research project delves into three elevation of privilege Common Vulnerabilities and Exposures (CVEs), namely CVE-2020-1170, CVE-2021-21551, and CVE-2023-21768. The objective is to scrutinise the effectiveness of the respective vendor's patching strategies, specifically examining whether patches comprehensively address the root cause of the vulnerabilities or merely mitigate specific methods of replication and exploitation. The methodology uses a combination of static analysis tools like Ghidra, IDA and BinDiff, as well as dynamic analysis tools like Process Monitor (ProcMon) and WinDbg. Each vulnerability was replicated on a virtual machine (VM) to conduct a detailed analysis of its impact on the operating system and its root cause. Next, we evaluated if their patches are sufficient at fully mitigating the root cause of the vulnerability. In our study of CVE-2020-1170 and CVE-2021-21551, we found that the patches do not completely mitigate the vulnerability as there are ways that attackers can bypass them. In contrast, we found that CVE-2023-21768 exhibits successful patching that prevents elevation of privileges. While vendors patch certain vulnerabilities effectively, our research emphasises the need for more comprehensive measures to ensure robust cybersecurity.