CVE-2013-3660: Microsoft Win32k Privilege Escalation Vulnerability
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."
Other sources
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.
— CISA
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3660?
CVE-2013-3660 has a critical severity rating due to its potential to allow arbitrary code execution.
How do I fix CVE-2013-3660?
To fix CVE-2013-3660, apply the relevant security updates released by Microsoft for the affected versions of Windows.
Which versions of Windows are affected by CVE-2013-3660?
CVE-2013-3660 affects Windows XP SP2 and SP3, Windows Vista SP2, Windows 7 SP1, Windows 8, and various Server editions.
What are the potential impacts of CVE-2013-3660?
The potential impacts of CVE-2013-3660 include system compromise and unauthorized access due to remote code execution.
Is there a workaround for CVE-2013-3660?
There are no reliable workarounds for CVE-2013-3660, so applying the appropriate patches is essential.