Windows 0-Day Dropped By Disgruntled Researcher Hands Hackers System Rights

An anonymous researcher, known online as Nightmare Eclipse, has disclosed a new Windows zero-day vulnerability dubbed SignDrop. The flaw allows local users to gain full System rights on certain versions of Windows. The vulnerability exists in the Common Log File System, a general-purpose logging service utilized by software clients operating in user-mode or kernel-mode.

By tricking a privileged process like Windows Defender into opening a specially crafted Common Log File System (CLFS) container, an attacker with basic user privileges can exploit the elevated file creation rights to attain System-level access.

Will Dormann, a researcher who has had a long-standing dispute with Microsoft, confirmed the exploit and its functionality. However, he noted that the attack is not universally applicable to all Windows 11 versions. The vulnerability requires the system to be running Windows 26H2, with an additional condition that the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode value must be set to either 0 or 1. Dormann's testing revealed that only one of the multiple machines he used met these requirements.

Microsoft responded by stating that they are investigating the vulnerability and have found no evidence of it being exploited in the wild. The company also mentioned that their Defender software is capable of blocking potential exploitation attempts.