Windows CSRSS Process Token Mismanagement Local Privilege Escalation Vulnerability (CVE-2016-0151, MS16-048)

1. Vulnerability Overview & Root Cause

This vulnerability exists in the Client-Server Run-time Subsystem (CSRSS) of Microsoft Windows, which is responsible for managing user-mode Win32 subsystem functions. The root cause lies in the mismanagement of process tokens within CSRSS when handling client-server communications. Due to insufficient validation and improper handling of security contexts during token duplication or assignment, a low-privileged local process can bypass security boundaries and manipulate process tokens to elevate its privileges.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first gain local execution access on the target system. The attacker then executes a specially crafted application designed to interact with CSRSS via LPC (Local Procedure Call) or specific subsystem APIs. By exploiting the token mismanagement flaw, the application forces CSRSS to assign or duplicate a high-privileged token (such as SYSTEM) to the attacker's process. This allows the attacker to bypass Windows security features and execute arbitrary commands with full administrative privileges.

3. Infrastructure & Business Impact

As a CISA KEV-listed vulnerability with a high EPSS score, this flaw represents a significant threat vector for local privilege escalation (LPE). In an enterprise environment, once an attacker establishes an initial foothold, they can leverage this vulnerability to compromise the entire host, disable endpoint detection and response (EDR) agents, access sensitive local databases, and facilitate lateral movement across the internal network.