CVE-2018-8120 in microsoft windows 7
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.
Affected software: microsoft windows 7, microsoft windows server 2008
Scores
- CVSS: 7.0 (high)
- EPSS: 73.29% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-03-15, used in ransomware
- Published: 2018-05-09
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Install the May 2018 (or later) Windows security update for Win32k CVE-2018-8120
Patch or upgrade. Installs Microsoft's May 2018 security update, which fixes how Win32k handles objects in memory. This closes the local privilege escalation to SYSTEM that ransomware and other attackers use after they get in.
Applies to: Windows 7 SP1 (32 and 64-bit), Windows Server 2008 SP2 and Windows Server 2008 R2 SP1, including Server Core, without the May 2018 security update. Windows 8.1, Windows 10 and later are not affected.
- List the hosts running Windows 7 SP1, Windows Server 2008 SP2 or Windows Server 2008 R2 SP1 (asset inventory, WSUS/ConfigMgr or Intune reports). On Server 2008 R2 also check Server Core installations.
- Windows 7 SP1 / Server 2008 R2 SP1: install the May 2018 Monthly Rollup KB4103718 or the Security-only update KB4103712. Any later Monthly Rollup also contains the fix and is the better choice.
- Windows Server 2008 SP2: install the May 2018 security update listed for your edition on the Microsoft advisory page for CVE-2018-8120, or any later Monthly Rollup.
- Deploy with WSUS, ConfigMgr or Windows Update and restart the hosts: the fix is not active until after the reboot.
- Check that it is installed: run 'wmic qfe list brief' or 'Get-HotFix' in PowerShell and look for the KB, or for a later rollup that replaces it.
- These operating systems are out of support. Plan to upgrade or replace them. Until then, keep them on Extended Security Updates where you can, and do not let untrusted users log on to them interactively.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.