Key points
- A Windows 11 Get Help flaw let standard users exploit DiagSvc to gain full SYSTEM control, and Microsoft fixed it quietly without issuing CVE identifiers.
- Researcher Ben Wilson of Tanto Security exploited two race conditions in the Media Creation Tool troubleshooter to swap in his own executable for SYSTEM to run.
- Microsoft paid Wilson US$8000 each for the Media Creation Tool and Outlook diagnostic bugs, while a third Calendar flaw remains unpaid and in disclosure.
A flaw in the Windows 11 Get Help troubleshooting platform that could let ordinary users take full control of a PC was fixed quietly by Microsoft, which didn’t issue CVE identifiers for the vulnerability.
Ben Wilson of Melbourne’s Tanto Security decided to look into the Get Help support system in Windows, which runs troubleshooting packages that, in turn, are bundles of PowerShell scripts hosted by Microsoft.
Get Help processes the scripts through a Windows feature called the Diagnostic Execution Service (DiagSvc) that runs with SYSTEM privileges.
SYSTEM is the highest privilege a process can have on a Windows computer, and it provides full device and operating system access.
Older Windows troubleshooters would ask for administrator approval for DiagSvc; on Windows 11, Wilson found that any standard user could launch the service directly, with no administrator approval prompt at all.
The vulnerable package Wilson focused on was one of Get Help’s troubleshooters that fetches Microsoft’s Media Creation Tool, a utility for building Windows installation media, and launches it.
Its script created a folder in a temporary directory that ordinary users could write to, downloaded the tool into it, and then ran it as SYSTEM.
Wilson exploited two race conditions, which are brief timing windows in which the order of events can be manipulated.
First, the script deleted any existing copy of the folder and paused to write a log entry before recreating it, giving Wilson’s code the chance to create the folder first and take full control of it.
Then, while the download finished, he staged his own program and swapped it in for the genuine executable, which the script duly launched as SYSTEM.
Script fixed, bounties paid but no CVEs issued
Having validated and documented the bug, Wilson reported it to the Microsoft Security Response Centre (MSRC) on May 13.
Microsoft confirmed the behaviour on June 29 before awarding a bounty the following day.
The fix arrived around September 1, and Wilson only found out when he went to record a demonstration for his talk.
“Microsoft’s fix for the Media Creation Tool bug was to change one line in the PowerShell script to prevent users from abusing a race condition to gain full control permissions over the download folder,” Wilson told iTnews.
“This in turn blocks overwriting the legitimate Media Creation Tool executable,” he said.
Wilson has yet to establish whether the patch can be sidestepped.
“I have not yet had time to fully test this patch to see if there are alternate bypasses,” he said.
Nor is the Media Creation Tool package the only one affected.
An Outlook bug, and a third flaw in the Calendar diagnostic package, also lie within Windows diagnostics but involve different packages and vulnerabilities, Wilson said.
Microsoft paid him US$8000 for the Media Creation Tool bug, and the same again for the second flaw he found in the Outlook diagnostic package.
The Calendar bug is still in disclosure, and he has not yet been paid for it.
No tracking identifiers using the security industry Common Vulnerabilities and Exposures (CVE) indexing system have been issued by Microsoft, Wilson said.
“I have not received any CVEs from Microsoft and I am not sure I ever will,” Wilson said.
That leaves administrators with no identifier or advisory to check their systems against.
To the best of Wilson’s knowledge, the Media Creation Tool flaw has not been exploited in the wild.
Wilson presented his “Troubleshooting to SYSTEM” talk at the BSides Canberra information security conference in September, and at Wellington’s Kawaiicon held last week.
