Google Discloses Windows Flaw That Microsoft Failed to Fix

Google has released the details of another Windows vulnerability. Microsoft planned on fixing the flaw with the January updates, but was forced to delay the patch due to compatibility issues.

The vulnerability disclosure “game” between Microsoft and Google continues. On Thursday, Google disclosed a security bypass/information disclosure bug affecting both Windows 7 and Windows 8.1. The flaw was reported to Microsoft on October 17 and its details were automatically made public after Google’s 90-day disclosure deadline expired.

“The function CryptProtectMemory allows an application to encrypt memory for one of three scenarios, process, logon session and computer. When using the logon session option (CRYPTPROTECTMEMORY_SAME_LOGON flag) the encryption key is generated based on the logon session identifier, this is for sharing memory between processes running within the same logon. As this might also be used for sending data from one process to another it supports extracting the logon session id from the impersonation token,” Google Project Zero researcher James Forshaw wrote in an advisory.

“The issue is the implementation in CNG.sys doesn’t check the impersonation level of the token when capturing the logon session id (using SeQueryAuthenticationIdToken) so a normal user can impersonate at Identification level and decrypt or encrypt data for that logon session. This might be an issue if there’s a service which is vulnerable to a named pipe planting attack or is storing encrypted data in a world readable shared memory section,” Forshaw added.

Microsoft informed Google in late October that they had managed to reproduce the issue. The company later told Google that it had planned to release a fix in January, but the patch had to be pulled due to compatibility issues. The vulnerability will likely be addressed in February, Microsoft said.

This is the third Windows vulnerability disclosed by Google before Microsoft could release a fix. After Google published the details for two Windows privilege escalation vulnerabilities, Microsoft criticized the search giant and accused it of putting users at risk.

Google was also criticized by some members of the infosec community for sticking to its 90-day disclosure deadline. The company has promised to review the process, but it believes “disclosure deadlines are currently the optimal approach for user security.”

“Although following through keeps to Google’s announced timeline for disclosure, the decision feels less like principles and more like a ‘gotcha’, with customers the ones who may suffer as a result. What’s right for Google is not always right for customers. We urge Google to make protection of customers our collective primary goal,” Chris Betz, senior director of Microsoft’s Security Response Center, wrote in a blog post.

Betz’s response came after Google disclosed the second privilege escalation vulnerability just two days before Microsoft released its Patch Tuesday security updates for January, which address both privilege escalation issues.

“Google is right,” said Errata Security’s Robert Graham. “Since we can’t make perfect software, we must make fast and frequent fixes the standard. Nobody should be in the business of providing ‘secure’ software that can’t turn around bugs quickly. Rather than 90 days being too short, it’s really too long. Microsoft either needs to move forward with the times and adopt ‘agile’ methodologies, or just accept its role of milking legacy for the next few decades as IBM does with mainframes.”