PT-2018-1809 · Microsoft · Windows Server 2016+8

Igor Glucksmann · Published 2018-11-13 · Updated 2019-10-03 · CVE-2018-8549

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Windows Server 2012 R2 Windows RT 8.1 Windows Server 2012 Windows Server 2019 Windows Server 2016 Windows 8.1 Windows 10 Windows 10 Servers

Description A security feature bypass exists due to incorrect validation of kernel driver signatures by Windows. This issue is related to errors in the kernel driver authentication mechanism, which can allow an attacker to load incorrectly signed drivers into the kernel.

Recommendations For Windows Server 2012 R2, update the operating system to a version that includes the security patch for this issue. For Windows RT 8.1, apply the recommended configuration changes to mitigate the risk of exploitation. For Windows Server 2012, consider disabling the loading of kernel drivers until a patch is available. For Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, and Windows 10 Servers, apply the necessary security updates to resolve the issue. As a temporary workaround, consider restricting access to the kernel driver loading mechanism to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2018-01409

CVE-2018-8549

Affected Products

Windows

Windows 10

Windows 10 Servers

Windows 8.1

Windows Rt 8.1

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

Windows Server 2019

References · 10

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8549 · Security Note
• https://bdu.fstec.ru/vul/2018-01409 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8549 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8549 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8549 · Vendor Advisory
• https://rapid7.com/db/vulnerabilities/msft-cve-2018-8549 · Note
• http://securityfocus.com/bid/105803 · Note
• https://securitylab.ru/vulnerability/496468.php · Note
• http://securitytracker.com/id/1042138 · Note