PT-2018-1661 · Microsoft · Win32K+12

CVE-2018-8453 · Publicado 2018-08-17 · Atualizado 2025-10-28

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers

Description The issue is related to the Win32k component (win32k.sys) in Windows operating systems, which fails to properly handle objects in memory, allowing an attacker to elevate privileges and execute arbitrary code using a specially crafted application. This can be exploited by ransomware such as Sodinokibi (also known as Sodin) to gain the highest level of privileges on a target system.

Recommendations For Windows 7, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2012 R2, update to a newer version or apply the relevant patch to fix the issue. For Windows RT 8.1, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2008, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2019, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2012, update to a newer version or apply the relevant patch to fix the issue. For Windows 8.1, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2016, update to a newer version or apply the relevant patch to fix the issue. For Windows Server 2008 R2, update to a newer version or apply the relevant patch to fix the issue. For Windows 10, update to a newer version or apply the relevant patch to fix the issue. For Windows 10 Servers, update to a newer version or apply the relevant patch to fix the issue. As a temporary workaround, consider restricting access to the Win32k component until a patch is available.

Exploit

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

BDU:2018-01220

CVE-2018-8453

Produtos afetados

Win32K

Windows

Windows 10

Windows 10 Servers

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

Referências · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2018_8453_win32k_priv_esc.rb · Exploit
• 🔥 https://github.com/ze0r/cve-2018-8453-exp · Exploit
• 🔥 https://github.com/thepwnrip/leHACK-Analysis-of-CVE-2018-8453 · Exploit
• 🔥 https://exploit-db.com/exploits/47134 · Exploit
• 🔥 http://packetstormsecurity.com/files/153669/Microsoft-Windows-NtUserSetWindowFNID-Win32k-User-Callback.html · Exploit
• 🔥 https://securelist.com/cve-2018-8453-used-in-targeted-attack · Exploit
• http://securityfocus.com/bid/105467 · Nota
• https://t.me/cvenotify/87297 · Publicação no Telegram
• https://securelist.ru/cve-2018-8453-used-in-targeted-attacks/91658 · Nota
• https://t.me/cvenotify/118074 · Publicação no Telegram
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8453 · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Nota
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8453 · Nota
• https://t.me/cibsecurity/5339 · Publicação no Telegram
• https://t.me/true_secator/725 · Publicação no Telegram