When calling the Win32k system call win32k!zzzHideCursorNoCapture (via NtUserCallNoParam), the return value of the function leaks a kernel-mode address to user-mode.
This function returns type void, and so RAX - which holds the kernel-mode address of a PCURSOR object in kernel memory - is inappropriately returned to usermode.
This vulnerability gives local attackers the ability to de-ASLR the kernel from any permission level, and could be used to stabilize a local kernel-mode read/write vulnerability as part of a kernel-mode exploit.
Labels:
Vendor-Microsoft
Product-Windows-Kernel
Severity-Medium
PublicOn-? (e.g. PublicOn-2014-Jul-26)
Finder-MattTait
Reported-2015-May-19
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
