Vulnerability CVE-2018-8233

Vulnerability Name:

CVE-2018-8233 (CCN-144020)

Assigned:

2018-06-12

Published:

2018-06-12

Updated:

2019-10-03

Summary:

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 10, Windows 10 Servers.

CVSS v3 Severity:

7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-404

Vulnerability Consequences:

Gain Privileges

References:

Source: MITRE
Type: CNA
CVE-2018-8233

Source: BID
Type: Third Party Advisory, VDB Entry
104383

Source: CCN
Type: BID-104383
Microsoft Windows Kernel 'Win32k.sys' CVE-2018-8233 Local Privilege Escalation Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1041093

Source: XF
Type: UNKNOWN
ms-win32k-cve20188233-priv-esc(144020)

Source: CCN
Type: Microsoft Security TechCenter - June 2018
Win32k Elevation of Privilege Vulnerability

Source: CONFIRM
Type: Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8233

Vulnerable Configuration:

Configuration 1:

cpe:/o:microsoft:windows_10:1803:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*

Configuration CCN 1:

cpe:/o:microsoft:windows_10:-:*:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_server:1803:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK