eEye Digital Security has discovered a local privilege escalation vulnerability in the Windows kernel that allows an unprivileged user with the ability to execute a program to fully compromise an affected system. All x86 versions of Windows up to and including Windows Server 2003 SP2 are vulnerable. The Windows kernel’s Virtual DOS Machine (VDM) implementation features a race condition through which a malicious program can modify the first 4KB page of physical memory (also known as the “zero page”). The data in this region of memory is trusted and may be subsequently used by other Virtual DOS Machines, including a VDM instantiated by the Windows kernel as part of hibernating or effecting a blue-screen crash. Exploitation of this vulnerability therefore allows arbitrary code to run within other users’ VDM processes, and even within the kernel if hibernation or a blue-screen can be provoked by any available means.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/55831/EEYE-vdmzero.txt
Source: https://packetstormsecurity.com/files/55831/EEYE-vdmzero.txt.html