CVE-2017-11830

Related Files

Microsoft Windows CiSetFileCache TOCTOU Security Feature Bypass

Posted Sep 19, 2018

Authored by James Forshaw, Google Security Research

Microsoft Windows suffers from a CiSetFileCache TOCTOU CVE-2017-11830 variant WDAC security feature bypass vulnerability.

tags | exploit, bypass

systems | windows

advisories | CVE-2017-11830, CVE-2018-8449

SHA-256 | eb52dc13fee602e4f4367c0eb42d933defb5c0336c73d90ce5236346a9ec00ba

Download | Favorite | View

Microsoft Windows CiSetFileCache TOCTOU Incomplete Fix

Posted Apr 17, 2018

Authored by James Forshaw, Google Security Research

The fix for CVE-2017-11830 is insufficient to prevent a normal user application adding a cached signing level to an unsigned file by exploiting a TOCTOU in CI leading to circumventing Device Guard policies.

tags | exploit

advisories | CVE-2017-11830, CVE-2018-0966

SHA-256 | 8bf899b59331805e3565783c1df52349bae6d10f5374cb34ff520b4495773303

Download | Favorite | View

Microsoft Windows CI CiSetFileCache TOCTOU Security Feature Bypass

Posted Nov 21, 2017

Authored by James Forshaw, Google Security Research

It is possible to add a cached signing level to an unsigned file by exploiting a TOCTOU in CI leading to circumvention of Device Guard policies and possibly PPL signing levels.

tags | exploit

advisories | CVE-2017-11830

SHA-256 | 10740234534d576953b78d366019b0eaed2b7e2f77b447ea307edd5c886a5515

Download | Favorite | View