PT-2018-17976 · Microsoft · Windows

Published 2018-02-26 · Updated 2018-03-21 · CVE-2018-7250

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to KB3086255

Description An issue was discovered in secdrv.sys that allows a local unprivileged attacker to leak 16 bits of uninitialized kernel PagedPool data due to an uninitialized kernel pool allocation in IOCTL 0xCA002813.

Recommendations For Microsoft Windows versions prior to KB3086255, apply the update KB3086255 to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-7250

Affected Products

Windows

References · 3

• 🔥 https://github.com/Elvin9/SecDrvPoolLeak · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7250 · Security Note
• https://github.com/Elvin9/SecDrvPoolLeak/blob/master/README.md · Note