The researcher Microsoft threatened just dropped a seventh Windows zero-day hours after Patch Tuesday

TL;DR

Chaotic Eclipse dropped RoguePlanet, their seventh Windows zero-day, hours after Microsoft’s record Patch Tuesday. It grants SYSTEM access on fully patched machines.

Chaotic Eclipse, the security researcher Microsoft threatened with criminal prosecution, has published a seventh Windows zero-day exploit. Called RoguePlanet, it grants attackers SYSTEM privileges on fully patched Windows 10 and 11 machines. The researcher released the proof-of-concept hours after Microsoft shipped its June Patch Tuesday update, which fixed a record 200 vulnerabilities.

RoguePlanet exploits a race condition in Windows Defender’s internal processing logic. Specifically, it is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability. An unprivileged user can redirect a file operation performed by Defender, which runs as SYSTEM, to execute attacker-controlled code at the highest privilege level.

“The exploit is a race condition, so it’s a hit or miss,” the researcher said. “I have managed to get a 100% success rate on some machines...

Copyright of this story solely belongs to thenextweb.com. To see the full text click HERE