SUMMARYA researcher known as Nightmare Eclipse disclosed SignDrop, a Windows zero-day in the Common Log File System that can let a local attacker gain full System privileges on some systems. Will Dormann reproduced the issue on certain Windows 11 setups, though the vulnerable configuration appears limited to machines running Windows 26H2 for more than 90 days with a specific registry value. Microsoft said it was investigating the flaw and had no evidence of active exploitation, and Defender blocks potential attempts.
An anonymous reader quotes a report from Ars Technica: Nightmare Eclipse, the pseudonym of a researcher with an ongoing, very public beef with Microsoft, has dropped yet another Windows zero-day. On Tuesday, Nightmare Eclipse disclosed SignDrop, a vulnerability that gives local users full System rights on some versions of Windows. The vulnerability resides in the Common Log File System, which Microsoft describes as a "general-purpose logging service used by software clients running in user-mode or kernel-mode." By forcing a privileged process such as Windows Defender to open a crafted CLFS container, an attacker with ordinary user rights can abuse the privileged file creation to elevate privileges to System.
[...] Researcher Will Dormann said in an interview that he has been able to reproduce the exploit and that it works as described, but not on all versions of Windows 11. But there's a catch, he said. "The requirements are important in that it seems to require Windows 26H2, and one that has existed for more than 90 days, it seems," he explained. "That is, you can't just take a new 26H2 system and install updates and have it work." For a system to be vulnerable, Dormann said, the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS\Authentication\Mode value must be 0 or 1." Of the many machines Dormann uses, only a single one met this requirement. Microsoft said in a statement that it was investigating the vulnerability and had no evidence it was being exploited in the wild. The company also said Defender blocks potential exploitation attempts.