Privilege Escalation in Microsoft Windows Kernel (CVE‑2013‑5065) Enables Local Privilege Gain
What It Is – CVE‑2013‑5065 is an improper input‑validation flaw in the Windows kernel driver NDProxy.sys. A local attacker can craft malformed data that bypasses checks and escalates to SYSTEM privileges.
Exploitability – The vulnerability is exploitable locally without authentication. Public proof‑of‑concept code exists; the CVSS base score is 7.8 (High).
Affected Products – Microsoft Windows operating systems that include the vulnerable NDProxy.sys driver (all supported versions at the time of disclosure).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The flaw demonstrates how inadequate privilege separation can let a low‑privilege user obtain full system rights, violating the control objective of “least‑privilege access”.
- Patch‑management evidence – Demonstrating that critical OS patches are applied and verified provides continuous audit evidence that your organization meets the “protect” function of NIST CSF 2.0.
- Defensible incident response – Knowing the existence of this kernel flaw lets you capture relevant logs (driver load events, privilege‑escalation alerts) to support a forensically sound response and satisfy regulator‑driven audit trails.
Recommended Actions
- Verify that the Microsoft security update addressing CVE‑2013‑5065 is deployed on all Windows endpoints.
- Enable and centralize Windows Event Log collection for driver‑load and privilege‑escalation events; correlate with endpoint detection tools.
- Review and tighten local account policies (e.g., enforce “Run as least privilege”, disable unnecessary local accounts).
- Incorporate the patch status into your continuous control‑monitoring dashboard to maintain real‑time evidence of compliance.
Source: CISA KEV – CVE‑2013‑5065