CVE-2016-0167
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2016-0167 is a HIGH privilege escalation vulnerability in the Microsoft Win32k kernel-mode driver with a CVSS 3.1 score of 7.8. The Win32k kernel-mode driver in multiple versions of Microsoft Windows allows local users to gain elevated privileges through a crafted application. This vulnerability is distinct from CVE-2016-0143 and CVE-2016-0165. Affected products include Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 (1507 and 1511), Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The vulnerability is known to be leveraged in ransomware campaigns. With an EPSS score of 0.07346 (91.59th percentile), this vulnerability shows significant exploitation activity in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1511 | - |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows vista | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securitytracker.com/id/1035529(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1035532(Broken Link, Third Party Advisory, VDB Entry)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-0167(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CVE-2016-0167 exploits a flaw in the Win32k kernel-mode driver that improperly manages privileges when handling objects in memory. The Win32k driver operates in kernel mode and is responsible for managing Windows graphical subsystem operations, including window management and GDI (Graphics Device Interface) functions. When the driver fails to properly validate or restrict access to certain kernel objects, a local attacker can craft an application that triggers the vulnerability to execute code in kernel mode, effectively gaining SYSTEM-level privileges from a standard user context. Win32k elevation of privilege vulnerabilities are a well-known class of Windows kernel exploits that have been repeatedly targeted by advanced threat actors.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2016-0167 carries a CVSS 3.1 score of 7.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation elevates the attacker to SYSTEM privileges, granting access to all data on the affected system including credentials stored in memory, encrypted files, and security-sensitive configurations.
Integrity (HIGH): With SYSTEM-level access, attackers can modify any file, install rootkits, alter security settings, disable antivirus software, and make persistent changes to the operating system.
Availability (HIGH): Full system compromise allows attackers to render the system inoperable, deploy ransomware, corrupt system files, or cause blue screen crashes.
Scope Unchanged: The vulnerability's scope is Unchanged, meaning the privilege escalation is contained within the Windows operating system environment where the vulnerable Win32k driver operates.
With an EPSS score of 0.07346 (91.59th percentile), this vulnerability demonstrates notable exploitation activity and should be prioritized for patching.
Exploit Maturity
CVE-2016-0167 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited by advanced threat actors, including the STRONTIUM/APT28 group, which was observed using this vulnerability in targeted attacks against government and military organizations. The exploit was used in conjunction with other vulnerabilities as part of sophisticated attack chains.
Ransomware association: This vulnerability is known to be leveraged in ransomware campaigns. Win32k privilege escalation vulnerabilities are commonly used by ransomware operators to gain SYSTEM privileges needed for encrypting entire systems and disabling security controls.
Attack surface: Exploitation requires local access or the ability to execute code on the target system (e.g., through a prior compromise, malicious document, or drive-by download). The vulnerability affects the Windows kernel-mode driver, which is present on all affected Windows versions.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03.
Remediation
- Apply Microsoft security bulletin MS16-039 immediately. Apply updates per vendor instructions. Consult the Microsoft Security Bulletin MS16-039 for specific patch guidance.
- Verify all affected Windows systems are patched. Identify all instances of affected Windows versions in your infrastructure (Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10, Windows Server 2008, Windows Server 2012). Use vulnerability scanning tools to ensure no systems are missed.
- Implement application whitelisting and exploit mitigations. Deploy application control solutions to prevent unauthorized executables from running. Enable Windows Defender Exploit Guard or EMET (Enhanced Mitigation Experience Toolkit) on supported systems.
- Monitor for privilege escalation attempts. Configure endpoint detection tools and SIEM systems to alert on suspicious process creation events, particularly processes escalating from standard user to SYSTEM privileges.
- Apply defense-in-depth measures. Ensure users operate with least-privilege accounts, deploy up-to-date endpoint protection, and restrict administrative access to minimize the impact of potential exploitation.
- Scan for indicators of prior exploitation. Review security logs for evidence of suspicious Win32k-related activity, unexpected SYSTEM-level process execution, or indicators associated with APT28 campaigns.
Technical Details
CVE-2016-0167 is a HIGH-severity vulnerability in the Microsoft Win32k kernel-mode driver. The attack vector is local, meaning the attacker must have the ability to execute code on the target system. The attack complexity is low, requiring no specialized conditions. No prior privileges are needed to initiate the attack, but user interaction is required, meaning a victim must execute a crafted application or open a malicious file.
Technical mechanism: The Win32k kernel-mode driver (win32k.sys) fails to properly handle objects in memory during certain graphical subsystem operations. By crafting a specially designed application that makes specific Win32k system calls with malformed parameters, an attacker can trigger a memory corruption condition in kernel mode. This allows the attacker to execute arbitrary code with kernel-level (SYSTEM) privileges, effectively bypassing all user-mode security controls.
CVSS 3.1 vector analysis: The vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a Local Attack Vector (requires code execution on target), Low Attack Complexity, No Privileges Required (standard user is sufficient), Required User Interaction (victim must run the crafted application), and HIGH impact across all CIA dimensions.
Affected products: Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 (1507 and 1511), Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2.
Frequently Asked Questions
Is CVE-2016-0167 being actively exploited?
Yes, CVE-2016-0167 is actively exploited in the wild, notably by the STRONTIUM/APT28 advanced threat group. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and has an EPSS score of 0.07346 (91.59th percentile). The vulnerability is also known to be leveraged in ransomware campaigns.
What products are affected by CVE-2016-0167?
Affected products include Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 (1507 and 1511), Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2. All systems running the Win32k kernel-mode driver on these Windows versions are vulnerable.
How do I fix CVE-2016-0167?
Apply the Microsoft Security Bulletin MS16-039 security update. Ensure all affected Windows systems are patched using vulnerability scanning and asset management tools. Implement application whitelisting and exploit mitigations as additional protective measures.
How severe is CVE-2016-0167?
CVE-2016-0167 is rated HIGH with a CVSS 3.1 score of 7.8. Its EPSS score of 0.07346 places it in the 91.59th percentile for exploitation likelihood. The vulnerability allows local privilege escalation to SYSTEM through a crafted application and is confirmed in ransomware campaigns and APT attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.