Windows Vulnerability Lets Arbitrary Code Run in Kernel Mode

Microsoft has patched a critical system vulnerability in Windows that allowed an attacker to “run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

Adobe Flash was also affected by the vulnerability. The vulnerability was discovered by Google researchers and they informed Microsoft and Adobe on October 21. Adobe fixed the security hold on October 26, whereas Microsoft supposedly kept it for their monthly patches.

Google offers a grace period of 7 days to vendors before disclosing vulnerabilities publicly. When Microsoft failed to release the patch after that grace period, Google went public on October 31.

Microsoft was obviously not happy with Google’s disclosure. But it's debatable whether such exploits should be patched immediately or companies should wait for their regular update cycle.

To Google’s defense, the company provided only basic info about the bug to warn the public without disclosing any critical information that could help cyber criminals in exploiting it. Microsoft admitted that Strontium, a group of hackers with Russian ties, was using the vulnerability to carry out low-volume spear-phishing attacks.

If you are a Windows user, please update your system immediately.