Patchfirst
Patchfirst
CVE-2018-8453 KEVRansomwarePublic exploit High · 7.8 EPSS 70.0%

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft · Win32k

Summary

The Win32k component in Microsoft Windows fails to properly handle objects in memory, producing an elevation of privilege flaw that affects multiple Windows client and server releases. An attacker with local access to a vulnerable system who can get a user to interact with a crafted element, such as opening a file or running an application, can gain elevated privileges, with no authentication required beforehand.

Official description · NVD

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Breakdown
82.2 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
1/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

First seen exploited 54 days before it was disclosed. Public exploit code (Metasploit) was available 1 day before disclosure.

  1. First seen exploitedVulnCheck KEV evidence54 days before
  2. Public exploit codeMetasploit1 day before
  3. Disclosedday 0
  4. Added to CISA KEVknown ransomware use; EU database agrees+3 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

1 , grouped by in kill-chain order, 1 cited passage 1

Privilege EscalationTA0004

Exploitation for Privilege Escalation T1068 Medium
AI mapping from the description · how it is exploited

Local privilege escalation via kernel component bug

An elevation of privilege vulnerability exists in Windows when the Win32k component
From the official description (NVD) Original (opens in a new tab) ↗
Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Stage CapabilitiesT1608 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

0 rules for this CVE · 31 general rules for its techniques

Rules for this CVE

0 that reference CVE-2018-8453 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploitation for Privilege EscalationT106831 general rules
All 31 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportintel471.com

Reports are matched by finding the exact id CVE-2018-8453 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

6 links, grouped by NVD tag (5 duplicates merged)

Vendor Advisory 1

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8453

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8453

Third Party Advisory 4

packetstormsecurity.com/files/153669/Microsoft-Windows-NtUserSetWindowFNID-Win32k-User-Callback.htmlsecurityfocus.com/bid/105467securitytracker.com/id/1041828securelist.com/cve-2018-8453-used-in-targeted-attack
↑ ↓ chooseEnter openEsc close