OS Vulnerabilities Flashcards

A security flaw in OS code that can be exploited to allow unauthorized actions. Because every device runs an OS, these flaws affect every application and user on the system. Vulnerabilities arise from coding errors, design flaws, or unanticipated component interactions — and may exist undiscovered for months or years.

Because every computer runs one. This universality makes the OS the most attractive attack surface — a single vulnerability in a widely-deployed OS version affects millions of systems simultaneously. Combine that with tens of millions of lines of code and the mathematical certainty of undiscovered flaws, and the OS becomes the highest-value target for attackers.

Microsoft's scheduled monthly security update, released on the second Tuesday of each month. A single Patch Tuesday may include dozens of patches addressing multiple vulnerability categories. Other major vendors follow similar scheduled cycles. The predictable schedule lets organizations plan testing — but also signals to attackers when new vulnerability details will be published.

A vulnerability allowing an attacker to run arbitrary code on a target system remotely — without physical access. The most severe OS vulnerability category. A successful RCE exploit gives the attacker full code execution capability: they can install malware, create backdoors, exfiltrate data, or take complete control of the system.

A vulnerability allowing an attacker or process to gain higher system privileges than granted. A standard user exploiting an EoP flaw might gain administrator or SYSTEM-level access. Often used as the second stage of an attack: gain initial limited access, then use EoP to escalate to full control.

A vulnerability allowing an attacker to circumvent a built-in OS security control — such as User Account Control (UAC), code signing enforcement, or Secure Boot. Does not directly grant access or execute code, but removes a layer of protection that other exploits rely on being blocked by.

A vulnerability known to attackers but with no patch available — either because the vendor is unaware, or a fix hasn't been released yet. The most dangerous category: there is no patch to apply. Mitigation must rely on compensating controls — disabling the affected feature, network segmentation, enhanced monitoring — while waiting for a vendor fix.

The competition between organizations deploying patches and attackers developing exploits. When Microsoft publishes a patch, it reveals the vulnerability's existence. Attackers reverse engineer the patch to identify the flaw and develop exploit code. The window between patch release and working exploit availability may be hours to days. Organizations must patch faster than attackers can weaponize.

A patch deployment strategy applying updates progressively: isolated test environment first → small pilot group → full production. Allows detection of compatibility issues before they affect all systems. Balances patch speed against operational stability. The test phase catches patches that break business-critical applications before the damage is widespread.

The state of a system that has downloaded and installed a patch but has not yet rebooted. Core OS patches — kernel changes, driver updates, security subsystem modifications — do not take effect until a restart flushes old code from memory. A system showing "installed" but not yet rebooted is NOT protected by that patch.

A recovery path that allows restoration of a system to its pre-patch state if a patch causes problems. Typically implemented via system images or snapshots taken before Patch Tuesday deployment. Without a fallback plan, a patch that breaks a critical application may cause hours of downtime. With one, affected systems can be restored in minutes.

Microsoft Security Response Center — Microsoft's official resource for security update information, vulnerability disclosures, and patch details. Available at msrc.microsoft.com. Security professionals use the MSRC to track Patch Tuesday releases, review CVE details, check CVSS severity scores, and monitor for critical out-of-band updates.