# CVE-2019-1458: Windows win32k uninitialized variable in task switching

Uninitialized field in win32k tagSERVERINFO lets user space set extra window data on FNID_SWITCH task-switch window, yielding limited arbitrary kernel write used for EoP.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Windows
- Credited: Maddie Stone, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2020-07-27)
- Disclosed: 2019-12-10
- CVE: CVE-2019-1458
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2019/CVE-2019-1458.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2019-1458
- Tags: domain:desktop impact:privesc kind:incident platform:project-zero sev:high tech:windows technique:chained technique:reverse-engineering technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** win32k.sys kernel driver, task-switch system window (FNID_SWITCH)
**Root cause:** The field *(gpsi + 0x154) in the global tagSERVERINFO structure is never initialized, so a user-space app can set extra window data on the FNID_SWITCH (0x280) task-switch window normally reserved for the kernel.
**Steps:**
1. Identify that gpsi->field at offset 0x154 is uninitialized for the FNID_SWITCH system window type
2. From user space call SetWindowLongPtr on the task-switch window (FNID_SWITCH, 0x280) to set extra window data
3. Supply an attacker-controlled pointer as the extra window data
4. Trigger the code path that dereferences and writes through that pointer, giving a limited write to an arbitrary kernel address
5. Use Bitmap objects to bypass ASLR and convert to arbitrary kernel read/write
6. Steal the SYSTEM token from the EPROCESS object to elevate privileges
**How found:** Not stated for the original discovery; Project Zero notes SetWindowLongPtr bugs are prevalent and a skilled researcher could find it by manual reverse engineering, tracing that FNID_SWITCH's gpsi field is uninitialized and following the path to the attacker-controlled pointer dereference; fuzzing judged harder due to syscall ordering.
**Exploitation:** Chained as the EoP stage inside a Chrome renderer exploit (CVE-2019-13720). Bitmaps provided ASLR bypass (leaking GdiSharedHandlerTable bitmap addresses on older builds, or AcceleratorTable/gSharedInfoHandleTable leak then free-and-replace with a Bitmap) and arbitrary kernel read/write; the exploit then stole the SYSTEM token from EPROCESS.
**Escalation:** Chained browser RCE (CVE-2019-13720) with this win32k EoP to gain SYSTEM; targeted Windows 7 x64 and Windows 10 1607 x64.
**Insight:** System window types (FNID_*) in win32k have per-type fields in gpsi that may never be initialized; audit SetWindowLongPtr handling for each system window class, and note Microsoft only patched FNID_SWITCH plus two others, leaving variant surface.