CVE-2018-8453 in microsoft windows 10 1507
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Affected software: microsoft windows 10 1507, microsoft windows 10 1607, microsoft windows 10 1703, microsoft windows 10 1709, microsoft windows 10 1803, microsoft windows 10 1809, microsoft windows 7, microsoft windows 8.1, microsoft windows rt 8.1, microsoft windows server 1709
Scores
- CVSS: 7.8 (high)
- EPSS: 70.04% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2022-01-21, used in ransomware
- Published: 2018-10-10
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Install the October 2018 Windows security update (Win32k CVE-2018-8453)
Patch or upgrade. Microsoft fixed the Win32k use-after-free (NtUserSetWindowFNID / xxxDestroyWindow) in the security updates of 9 October 2018. Installing that update, or any later cumulative update, removes the local privilege escalation to SYSTEM.
Applies to: All supported Windows client and server versions as of October 2018 (Windows 7, 8.1, RT 8.1, 10 1507-1809, Server 2008/2008 R2/2012/2012 R2/2016/2019, Server 1709/1803) without the 9 October 2018 security update or a later one.
- List the Windows hosts that have not installed the security updates of October 2018 or later: Windows 7, 8.1, RT 8.1, 10 (1507 to 1809) and Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 1709 and 1803.
- Open the Microsoft Security Update Guide entry for CVE-2018-8453 and note the KB article for each Windows version and build you run (monthly rollup or security-only update for Windows 7/8.1 and Server 2008/2012, cumulative update for Windows 10 and Server 2016/2019).
- Approve the October 2018 update, or preferably the latest cumulative update for that Windows version, in WSUS, Microsoft Configuration Manager, Intune or your patch tool. Any later cumulative update contains this fix.
- Prioritise hosts where untrusted users log on interactively (terminal servers, Citrix/RDS hosts, workstations), since exploitation needs local code execution.
- Restart the hosts so the patched win32k drivers are loaded.
- Hosts on an operating system that no longer gets updates (Windows 7, Server 2008/2008 R2 without ESU) are vulnerable to this and later Win32k flaws: upgrade or isolate them.
- Confirm the result in your vulnerability scanner: the CVE must no longer be reported for the host.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.