Google has released the details of another Windows vulnerability. Microsoft planned on fixing the flaw with the January updates, but was forced to delay the patch due to compatibility issues.
The vulnerability disclosure “game” between Microsoft and Google continues. On Thursday, Google disclosed a security bypass/information disclosure bug affecting both Windows 7 and Windows 8.1. The flaw was reported to Microsoft on October 17 and its details were automatically made public after Google’s 90-day disclosure deadline expired.
“The function CryptProtectMemory allows an application to encrypt memory for one of three scenarios, process, logon session and computer. When using the logon session option (CRYPTPROTECTMEMORY_SAME_LOGON flag) the encryption key is generated based on the logon session identifier, this is for sharing memory between processes running within the same logon. As this might also be used for sending data from one process to another it supports extracting the logon session id from the impersonation token,” Google Project Zero researcher James Forshaw wrote in an advisory.
“The issue is the implementation in CNG.sys doesn’t check the impersonation level of the token when capturing the logon session id (using SeQueryAuthenticationIdToken) so a normal user can impersonate at Identification level and decrypt or encrypt data for that logon session. This might be an issue if there’s a service which is vulnerable to a named pipe planting attack or is storing encrypted data in a world readable shared memory section,” Forshaw added.
Microsoft informed Google in late October that they had managed to reproduce the issue. The company later told Google that it had planned to release a fix in January, but the patch had to be pulled due to compatibility issues. The vulnerability will likely be addressed in February, Microsoft said.
This is the third Windows vulnerability disclosed by Google before Microsoft could release a fix. After Google published the details for two Windows privilege escalation vulnerabilities, Microsoft criticized the search giant and accused it of putting users at risk.
Google was also criticized by some members of the infosec community for sticking to its 90-day disclosure deadline. The company has promised to review the process, but it believes “disclosure deadlines are currently the optimal approach for user security.”
“Although following through keeps to Google’s announced timeline for disclosure, the decision feels less like principles and more like a ‘gotcha’, with customers the ones who may suffer as a result. What’s right for Google is not always right for customers. We urge Google to make protection of customers our collective primary goal,” Chris Betz, senior director of Microsoft’s Security Response Center, wrote in a blog post.
Betz’s response came after Google disclosed the second privilege escalation vulnerability just two days before Microsoft released its Patch Tuesday security updates for January, which address both privilege escalation issues.
“Google is right,” said Errata Security’s Robert Graham. “Since we can’t make perfect software, we must make fast and frequent fixes the standard. Nobody should be in the business of providing ‘secure’ software that can’t turn around bugs quickly. Rather than 90 days being too short, it’s really too long. Microsoft either needs to move forward with the times and adopt ‘agile’ methodologies, or just accept its role of milking legacy for the next few decades as IBM does with mainframes.”

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Unpatched Econolite Traffic Controller Vulnerabilities Allow Remote Hacking
- Google Fi Data Breach Reportedly Led to SIM Swapping
- Microsoft’s Verified Publisher Status Abused in Email Theft Campaign
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
- Meta Awards $27,000 Bounty for 2FA Bypass Vulnerability
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Hive Ransomware Operation Shut Down by Law Enforcement
Latest News
- Malicious NPM, PyPI Packages Stealing User Information
- VMware Confirms Exploit Code Released for Critical vRealize Logging Vulnerabilities
- 98% of Firms Have a Supply Chain Relationship That Has Been Breached: Analysis
- Dutch, European Hospitals ‘Hit by Pro-Russian Hackers’
- Gem Security Gets $11 Million Seed Investment for Cloud Incident Response Platform
- Ransomware Leads to Nantucket Public Schools Shutdown
- Stop, Collaborate and Listen: Disrupting Cybercrime Networks Requires Private-Public Cooperation and Information Sharing
- Boxx Insurance Raises $14.4 Million in Series B Funding
