New Windows zero-day turns Microsoft's own security fix into a path to full system access

Microsoft's recent security fix for a zero-day vulnerability has inadvertently transformed into a pathway for attackers to gain full system access. This issue, dubbed SignDrop, was unveiled by Abdelhamid Naceri, a former Microsoft employee who has been leaking unpatched Windows flaws under the name Nightmare Eclipse since April. Naceri published the exploit on GitHub on the same day Microsoft rolled out its November security updates.

The root of the problem lies in the Common Log File System (CLFS), a component that manages logs for apps and drivers in Windows. The CLFS generates a companion file for each log to aid in recovery. The permissions for this file are inherited from the original log. Microsoft's antivirus, Defender, runs with elevated privileges and can be manipulated by the SignDrop exploit.

SignDrop leverages this vulnerability by tricking Defender into opening a pre-prepared log. This leads to the creation of a companion file with the highest permissions, despite the attacker controlling it. The attacker can then establish a command prompt running under the SYSTEM account, which holds more control over the PC than even an administrator account.

Initial tests confirmed the exploit's feasibility, but only on Windows 11 26H2 update PCs that have been in use for over 90 days. Microsoft is currently investigating the flaw and asserts that Defender is designed to detect and block this attack. However, given Naceri's history of releasing Defender exploits that later appeared in real-world attacks, such as BlueHammer, caution is warranted. A patch is expected before Microsoft's Patch Tuesday on December 8th, barring any last-minute developments.