WORLDTECHMicrosoft fixes Windows 11 Get Help flaw that let standard users reach SYSTEM
According to a report by iTnews, Microsoft has fixed a flaw in the Get Help troubleshooting platform of Windows 11 that allowed standard users to run code with SYSTEM privileges, and it did so without making a public announcement. The company issued no CVE identifiers for the bug, which was found by Ben Wilson of Melbourne's Tanto Security.
How the troubleshooter flaw was abused
Get Help runs troubleshooting packages, which are bundles of PowerShell scripts hosted by Microsoft. Those scripts are processed through the Diagnostic Execution Service, known as DiagSvc, a component that operates with SYSTEM rights, the highest privilege level a process can hold on a Windows machine.
Wilson examined the troubleshooter that retrieves the Media Creation Tool, a utility used to build Windows installation media. The script created a folder in a temporary directory that ordinary users were able to write to, placed the tool inside it, and launched it under SYSTEM.
Wilson exploited two race conditions, brief windows of time in which the order of events can be rearranged. The script removed any existing copy of the folder and paused to record a log entry before recreating it. During that pause, Wilson's code could create the folder first, take control of it, and substitute its own executable, which would then be started under SYSTEM.
Service access no longer requires approval
Earlier Windows troubleshooters asked for administrator approval before DiagSvc could be started. On Windows 11, Wilson found that any standard user could start the service directly, with no administrator approval prompt appearing at all.
Bounties and unresolved items
Microsoft paid Wilson US$8000 each for the Media Creation Tool and Outlook diagnostic bugs, US$16,000 in total. A third flaw, in the Calendar diagnostics, remains unpaid and is still under disclosure. The account rests on a single outlet, and the facts do not say how many users were exposed.
Open questions
- Will Microsoft assign CVE identifiers to the fixed flaws later?
- When will the unpaid Calendar diagnostics flaw be resolved?