CVE-2018-8298 in microsoft chakracore
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
Affected software: microsoft chakracore
Scores
- CVSS: 7.5 (high)
- EPSS: 74.69% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-03-03
- Published: 2018-07-11
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Update or replace ChakraCore and Edge Legacy (CVE-2018-8298)
Patch or upgrade. Installs Microsoft's July 2018 security fixes for the Chakra scripting engine and removes the end-of-life Edge Legacy and ChakraCore components, so a malicious web page can no longer use the Intl type confusion to run code.
Applies to: Microsoft ChakraCore and the Chakra engine in Microsoft Edge Legacy on Windows 10 before the July 2018 security updates.
- List the hosts that run Microsoft Edge Legacy (EdgeHTML) or ship applications that embed ChakraCore (ChakraCore.dll), for example with your software inventory.
- On Windows 10 hosts with Edge Legacy, install the latest Windows cumulative update (any update from July 2018 or later contains the fix for CVE-2018-8298) through Windows Update or WSUS.
- Replace Edge Legacy with the Chromium-based Microsoft Edge; Edge Legacy is out of support and gets no further security fixes.
- For applications that bundle ChakraCore, update ChakraCore.dll to the latest release from the Microsoft ChakraCore GitHub project, or ask the application vendor for a build with a current engine.
- Because Microsoft ended support for ChakraCore in March 2021, plan to retire or replace applications that still embed it.
- Confirm with your vulnerability scanner that CVE-2018-8298 is no longer reported.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.