Windows Client for NFSの脆弱性で、ローカルで権限を昇格される
Summary
Windows Client for NFSに、競合状態を悪用して権限を昇格される脆弱性が見つかりました。認証を受けた攻撃者が、ローカルで管理者相当の権限を得るおそれがあります。Windows 10 Version 1607・1809・21H2・22H2、Windows 11 Version 23H2・24H2が対象で、各版の修正版が公開されています。対象の版を使っている場合は、早めに修正版を適用してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Windows Client for NFSに、競合状態を悪用して権限を昇格される脆弱性が見つかりました。認証を受けた攻撃者が、ローカルで管理者相当の権限を得るおそれがあります。Windows 10 Version 1607・1809・21H2・22H2、Windows 11 Version 23H2・24H2が対象で、各版の修正版が公開されています。対象の版を使っている場合は、早めに修正版を適用してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| MicrosoftWindows 10 Version 1607 |
≥ 10.0.14393.0, < 10.0.14393.9688→ 10.0.14393.9688 |
10.0.14393.9688 |
| MicrosoftWindows 10 Version 1809 |
≥ 10.0.17763.0, < 10.0.17763.9487→ 10.0.17763.9487 |
10.0.17763.9487 |
| MicrosoftWindows 10 Version 21H2 |
≥ 10.0.19044.0, < 10.0.19044.7846→ 10.0.19044.7846 |
10.0.19044.7846 |
| MicrosoftWindows 10 Version 22H2 |
≥ 10.0.19045.0, < 10.0.19045.7846→ 10.0.19045.7846 |
10.0.19045.7846 |
| MicrosoftWindows 11 Version 23H2 |
≥ 10.0.22631.0, < 10.0.22631.7711→ 10.0.22631.7711 |
10.0.22631.7711 |
| MicrosoftWindows 11 Version 24H2 |
≥ 10.0.26100.0, < 10.0.26100.9974→ 10.0.26100.9974 |
10.0.26100.9974 |
| MicrosoftWindows 11 Version 25H2 |
≥ 10.0.26200.0, < 10.0.26200.9974→ 10.0.26200.9974 |
10.0.26200.9974 |
| MicrosoftWindows 11 version 26H1 |
≥ 10.0.28000.0, < 10.0.28000.3501→ 10.0.28000.3501 |
10.0.28000.3501 |
| MicrosoftWindows 11 Version 26H2 |
≥ 10.0.26300.0, < 10.0.26300.9974→ 10.0.26300.9974 |
10.0.26300.9974 |
| MicrosoftWindows Server 2016 |
≥ 10.0.14393.0, < 10.0.14393.9688→ 10.0.14393.9688 |
10.0.14393.9688 |
| MicrosoftWindows Server 2016 (Server Core installation) |
≥ 10.0.14393.0, < 10.0.14393.9688→ 10.0.14393.9688 |
10.0.14393.9688 |
| MicrosoftWindows Server 2019 |
≥ 10.0.17763.0, < 10.0.17763.9487→ 10.0.17763.9487 |
10.0.17763.9487 |
| MicrosoftWindows Server 2019 (Server Core installation) |
≥ 10.0.17763.0, < 10.0.17763.9487→ 10.0.17763.9487 |
10.0.17763.9487 |
| MicrosoftWindows Server 2022 |
≥ 10.0.20348.0, < 10.0.20348.5870→ 10.0.20348.5870 |
10.0.20348.5870 |
| MicrosoftWindows Server 2025 |
≥ 10.0.26100.0, < 10.0.26100.33822→ 10.0.26100.33822 |
10.0.26100.33822 |
| MicrosoftWindows Server 2025 (Server Core installation) |
≥ 10.0.26100.0, < 10.0.26100.33822→ 10.0.26100.33822 |
10.0.26100.33822 |
Original description The description as published by the source.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
Source: Microsoft Security Response Center Blog NVD GitHub Advisory
References
- web msrc.microsoft.com
- web nvd.nist.gov
- web github.com