CVE-2018-8120 : An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.

Published 2018-05-09 19:29:01

Updated 2019-10-03 00:03:26

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Gain privilege

CVE-2018-8120 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

Microsoft Win32k Privilege Escalation Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.

Added on 2022-03-15 Action due date 2022-04-05

Exploit prediction scoring system (EPSS) score for CVE-2018-8120

Probability of exploitation activity in the next 30 days: 97.43%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2018-8120

Windows SetImeInfoEx Win32k NULL Pointer Dereference

Disclosure Date: 2018-05-09

First seen: 2020-04-26

exploit/windows/local/ms18_8120_win32k_privesc

This module exploits elevation of privilege vulnerability that exists in Windows 7 and 2008 R2 when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An

More information

CVSS scores for CVE-2018-8120

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.0	HIGH	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.0	5.9	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-8120

CWE-404 Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-8120

http://www.securityfocus.com/bid/104034

Microsoft Windows Kernel 'Win32k.sys' CVE-2018-8120 Local Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry
https://www.exploit-db.com/exploits/45653/

Microsoft Windows - SetImeInfoEx Win32k NULL Pointer Dereference (Metasploit)
Exploit;Third Party Advisory;VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8120

CVE-2018-8120 | Win32k Elevation of Privilege Vulnerability
Patch;Vendor Advisory
http://www.securitytracker.com/id/1040849

Windows Kernel Multiple Flaws Let Local Users Bypass Security Restictions, Obtain Potentially Sensitive Information, and Gain Elevated Privileges on the Target System - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url

Products affected by CVE-2018-8120

Microsoft » Windows Server 2008 » Version: N/A Update SP2
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Update SP1 For Itanium
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
Matching versions
Microsoft » Windows 7 » Version: N/A Update SP1
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2018-8120