0patching the "BearLPE" local privilege escalation 0day in Task Scheduler скачать в хорошем качестве

0patching the "BearLPE" local privilege escalation 0day in Task Scheduler

This video shows how our micropatch fixes the "BearLPE" vulnerability (without official patch at the time of issuing this video), which was published on the Internet by SandboxEscaper in May 2019. Running the POC without our micropatch present changes permissions and ownership on a system file (pci.sys, but could be any other), allowing a local low-privileged attacker to change any system file. The virtual machine is then reverted to snapshot to restore pci.sys's original permissions and ownership. Finally, with 0patch Agent enabled and our micropatch applied, the POC no longer succeeds in changing system file's permissions.