CVE-2013-3660
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2013-3660 is a privilege escalation vulnerability (CWE-269) in the Microsoft Windows Win32k kernel-mode driver that allows a local attacker to execute arbitrary code with SYSTEM privileges by exploiting a flaw in the EPATHOBJ::pprFlattenRec function. The vulnerability arises from improper handling of path objects during graphics rendering operations, enabling a local user to escalate from standard user privileges to full kernel-level access. CISA has confirmed active exploitation and added CVE-2013-3660 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 69.2% (71.9th percentile), this vulnerability presents a significant local privilege escalation risk.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows 8 | - |
| microsoft | windows rt | - |
| microsoft | windows server 2003 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | - |
| microsoft | windows vista | - |
| microsoft | windows xp | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html(Broken Link)
- http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html(Broken Link)
- http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html(Broken Link)
- http://secunia.com/advisories/53435(Broken Link, Vendor Advisory)
- http://twitter.com/taviso/statuses/309157606247768064(Exploit)
- http://twitter.com/taviso/statuses/335557286657400832(Not Applicable)
- http://www.computerworld.com/s/article/9239477(Broken Link)
- http://www.exploit-db.com/exploits/25611/(Exploit, Third Party Advisory, VDB Entry)
- http://www.osvdb.org/93539(Broken Link)
- http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/(Exploit, Issue Tracking)
- http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw(Press/Media Coverage)
- http://www.us-cert.gov/ncas/alerts/TA13-190A(Third Party Advisory, US Government Resource)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3660(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes a weakness where software does not properly assign, modify, track, or check privileges for an actor, enabling unauthorized privilege escalation. In CVE-2013-3660, the Win32k kernel-mode driver fails to properly validate and manage object references during path flattening operations, allowing a local attacker to corrupt kernel memory and execute arbitrary code with elevated privileges.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2013-3660 enables a locally authenticated attacker to escalate privileges from a standard user account to SYSTEM-level access through exploitation of the Win32k kernel driver. The Win32k component runs in kernel mode, so successful exploitation grants the attacker ring 0 code execution and complete control over the operating system. Confidentiality, integrity, and availability are all fully compromised: the attacker can access all files and credentials on the system, install kernel-level rootkits that are invisible to user-mode security tools, modify or delete any data, and render the system inoperable. The vulnerability is particularly valuable in post-exploitation scenarios where an attacker has gained initial access through a browser exploit or phishing attack and needs to escalate privileges for persistent system-level access.
Exploit Maturity
CVE-2013-3660 is confirmed as actively exploited in the wild by CISA and is listed in the Known Exploited Vulnerabilities catalog. Detailed proof-of-concept exploit code targeting the EPATHOBJ::pprFlattenRec function has been publicly available since the vulnerability's disclosure, and the exploitation technique has been extensively documented by security researchers. The EPSS score of 69.2% (71.9th percentile) reflects meaningful real-world exploitation activity. Win32k privilege escalation vulnerabilities are highly prized by attackers due to the direct path from user-mode to kernel-mode execution they provide.
Remediation
- Apply the Microsoft security update MS13-053 (July 2013) to patch the Win32k vulnerability on all affected Windows systems immediately.
- Implement the principle of least privilege across all user accounts to limit the impact of privilege escalation vulnerabilities and reduce the attack surface.
- Deploy endpoint detection and response (EDR) tools with kernel-level visibility to detect Win32k exploitation attempts, which typically involve specific system call patterns associated with GDI object manipulation.
- Enable kernel-mode code integrity (KMCI) and virtualization-based security (VBS) on Windows 10 and later to provide additional protection against kernel-level exploitation.
- Conduct a comprehensive audit of systems still running Windows versions vulnerable to CVE-2013-3660 and prioritize migration to fully patched, supported operating system versions.
Technical Details
CVE-2013-3660 is a privilege escalation vulnerability in the Win32k kernel-mode driver (win32k.sys) caused by an exploitable condition in the EPATHOBJ::pprFlattenRec function, which is responsible for flattening Bezier curves in GDI path objects. The vulnerability occurs when the function processes a specially crafted path object that triggers a write to an attacker-controlled memory location within kernel space. By creating GDI path objects with specific properties and manipulating the watchdog thread timing, an attacker can trigger the vulnerable code path and achieve a controlled kernel memory write primitive. This write primitive can then be used to overwrite kernel data structures such as the process token or the HalDispatchTable to redirect execution to attacker-supplied code, achieving arbitrary code execution in kernel mode from a standard user process.
Frequently Asked Questions
Is CVE-2013-3660 being actively exploited?
Yes. CVE-2013-3660 is confirmed as actively exploited in the wild and is listed in the CISA KEV catalog. Public proof-of-concept exploit code targeting the EPATHOBJ::pprFlattenRec function has been available since 2013, and the EPSS score of 69.2% (71.9th percentile) reflects meaningful exploitation activity.
What products are affected by CVE-2013-3660?
CVE-2013-3660 affects the Win32k kernel-mode driver (win32k.sys) across multiple Microsoft Windows versions, including Windows XP, Windows Vista, Windows 7, Windows 8, Windows Server 2003, Windows Server 2008, and Windows Server 2012.
How do I fix CVE-2013-3660?
Apply the Microsoft security update MS13-053 (July 2013) on all affected Windows systems. For long-term protection, migrate to modern Windows versions with virtualization-based security (VBS) and kernel-mode code integrity (KMCI) enabled.
How severe is CVE-2013-3660?
CVE-2013-3660 is a high-severity privilege escalation vulnerability that grants kernel-mode code execution from a standard user account. The CISA KEV listing and publicly available exploit code make this a significant security risk for any unpatched Windows system.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.