Windows 存储特权提升漏洞

该漏洞允许攻击者在受影响的系统上提升权限。攻击者可能首先通过其他漏洞获得较低权限的访问，然后利用此漏洞提升至系统管理员权限。成功利用此漏洞后，攻击者可以安装恶意软件、查看或修改数据、创建新的帐户，甚至完全控制受影响的系统。由于 Windows Storage 是操作系统核心组件，因此该漏洞的潜在影响范围非常广泛，可能影响整个网络的安全。

Systems administrators and users with administrative privileges are at the highest risk. Environments with legacy Windows configurations or those that have disabled automatic updates are particularly vulnerable. Shared hosting environments where multiple users share the same system could also be impacted, as a compromised user account could potentially be leveraged to escalate privileges.

• windows / supply-chain:

Get-WinEvent -LogName Security -Filter "EventID = 4688 -MessageText '*\Storage* privilege*escalation*'"

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*storage*'} | Select-Object ProcessName, CommandLine

• windows / supply-chain: Check Autoruns for suspicious entries related to Windows Storage processes. • windows / supply-chain: Monitor Windows Defender for alerts related to privilege escalation attempts involving Windows Storage components.

1. 2024-04-09Disclosure

   disclosure

1. 已保留2024-03-14
2. 发布日期2024-04-09
3. 修改日期2025-08-27
4. EPSS 更新日期2026-04-02

最有效的缓解措施是立即将 Windows Storage 更新至版本 10.0.25398.830 或更高版本。如果无法立即更新，可以考虑实施以下临时缓解措施：限制对 Windows Storage 组件的访问权限，使用最小权限原则；实施严格的访问控制策略，限制用户和应用程序的权限；监控系统日志，检测可疑活动；如果可能，隔离受影响的系统，以防止漏洞扩散。更新后，请验证更新是否成功安装，并确认系统功能正常。