LegacyHive Windows Zero-Day Gets Free Unofficial 0Patch Micropatches
Summary
LegacyHive, a Windows User Profile Service flaw, may let non-admin users alter another user’s registry hive and trigger code execution at admin login. ACROS Security offers free 0Patch micropatches while Microsoft investigates.
Key points
- Nightmare Eclipse disclosed LegacyHive in the Windows User Profile Service without a CVE ID and released a proof-of-concept exploit.
- Tharros analyst Will Dormann said non-admin users can modify the classes registry hive and potentially trigger code execution when an administrator logs in.
- Kevin Beaumont confirmed the exploit works and published Microsoft Defender for Endpoint detection queries.
- Microsoft said it is investigating the reported vulnerability’s validity and potential applicability.
- ACROS Security offers free 0Patch micropatches for Windows 10 version 2004 or later and Windows Server 2022 or later; the company says the patch redirects the exploit to a temporary profile hive.
- Installing the 0Patch agent deploys the micropatch automatically unless custom patching policies block it, and no restart is required.
Article Details
- Vulnerability Types
- Privilege escalation
- Code execution
- Affected Versions
- Windows 10 2004 or later
- Windows Server 2019 or later
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- partial
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationLegacyHive is reported to let non-admin users exploit the flaw to escalate privileges.T1112 · Modify RegistryThe exploit lets a non-admin user modify another user's registry hive.T1547 · Boot or Logon Autostart ExecutionA modified registry hive can affect what executes when the administrator next logs in.
People
Kevin BeaumontConfirmed that the exploit worked and published LegacyHive detection queries for Microsoft Defender for Endpoint.Mitja KolsekACROS Security CEO who described the vulnerability and how the 0Patch micropatch changes the loaded user profile hive.Nightmare EclipseThe security researcher, identified by this handle, disclosed LegacyHive and published a stripped proof-of-concept exploit.Will DormannTharros principal vulnerability analyst who analyzed the proof of concept and described how non-admin users could modify the classes registry hive and trigger code execution at administrator login.
Vendors
ACROS SecurityThe flaw was disclosed by Nightmare Eclipse, confirmed by researchers and Kevin Beaumont, and Microsoft says it is investigating while ACROS Security’s 0Patch offers protection for supported Windows versions.MicrosoftThe flaw was disclosed by Nightmare Eclipse, confirmed by researchers and Kevin Beaumont, and Microsoft says it is investigating while ACROS Security’s 0Patch offers protection for supported Windows versions.
Products
0PatchThe flaw was disclosed by Nightmare Eclipse, confirmed by researchers and Kevin Beaumont, and Microsoft says it is investigating while ACROS Security’s 0Patch offers protection for supported Windows versions.Microsoft Defender for EndpointCybersecurity expert Kevin Beaumont also confirmed that the exploit works one day after the PoC was released and published LegacyHive exploitation detection queries for Microsoft Defender for Endpoint.Microsoft WindowsFree unofficial micropatches are available for LegacyHive, a Windows zero-day in the User Profile Service that can let non-admin attackers escalate privileges and trigger code execution when an administrator logs in.