ByteOS Network

NVD Vulnerability Details :

CVE-2013-3660

Deferred

Known KEV

More Info Official Page

Source-cve@mitre.org

View Known Exploited Vulnerability (KEV) details

Published At-24 May, 2013 | 20:55

Updated At-11 Apr, 2025 | 00:51

The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-03-28	2022-04-18	Microsoft Win32k Privilege Escalation Vulnerability	Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

Microsoft Corporation

>>windows_7>>-

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

Microsoft Corporation

>>windows_8>>-

cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_rt>>-

cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2003>>-

cpe:2.3:o:microsoft:windows_server_2003:-:sp2:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2008>>-

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2008>>r2

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

Microsoft Corporation

>>windows_server_2012>>-

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_vista>>-

cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

Microsoft Corporation

>>windows_xp>>-

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:x64:*

Microsoft Corporation

>>windows_xp>>-

cpe:2.3:o:microsoft:windows_xp:-:sp3:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-119	Primary	nvd@nist.gov
CWE-119	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html	cve@mitre.org	Broken Link
http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html	cve@mitre.org	Broken Link
http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html	cve@mitre.org	Broken Link
http://secunia.com/advisories/53435	cve@mitre.org	Broken Link Vendor Advisory
http://twitter.com/taviso/statuses/309157606247768064	cve@mitre.org	Exploit
http://twitter.com/taviso/statuses/335557286657400832	cve@mitre.org	Not Applicable
http://www.computerworld.com/s/article/9239477	cve@mitre.org	Broken Link
http://www.exploit-db.com/exploits/25611/	cve@mitre.org	Exploit Third Party Advisory VDB Entry
http://www.osvdb.org/93539	cve@mitre.org	Broken Link
http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/	cve@mitre.org	Exploit Issue Tracking
http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw	cve@mitre.org	Press/Media Coverage
http://www.us-cert.gov/ncas/alerts/TA13-190A	cve@mitre.org	Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053	cve@mitre.org	Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360	cve@mitre.org	Broken Link
http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0090.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://archives.neohapsis.com/archives/fulldisclosure/2013-05/0094.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0006.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://secunia.com/advisories/53435	af854a3a-2127-422b-91ae-364da2661108	Broken Link Vendor Advisory
http://twitter.com/taviso/statuses/309157606247768064	af854a3a-2127-422b-91ae-364da2661108	Exploit
http://twitter.com/taviso/statuses/335557286657400832	af854a3a-2127-422b-91ae-364da2661108	Not Applicable
http://www.computerworld.com/s/article/9239477	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.exploit-db.com/exploits/25611/	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory VDB Entry
http://www.osvdb.org/93539	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/	af854a3a-2127-422b-91ae-364da2661108	Exploit Issue Tracking
http://www.theverge.com/2013/5/23/4358400/google-engineer-bashes-microsoft-discloses-windows-flaw	af854a3a-2127-422b-91ae-364da2661108	Press/Media Coverage
http://www.us-cert.gov/ncas/alerts/TA13-190A	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-053	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17360	af854a3a-2127-422b-91ae-364da2661108	Broken Link

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History