CVE-2018-8405
Published: 15 August 2018
Summary
CVE-2018-8405 is a high-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 2.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and AC-3 (Access Enforcement).
Deeper analysis
The vulnerability CVE-2018-8405 is an elevation of privilege issue in the DirectX Graphics Kernel (DXGKRNL) driver that arises from improper handling of objects in memory. It affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, and Windows 10 Servers, and is tracked separately from related issues under CVE-2018-8400, CVE-2018-8401, and CVE-2018-8406. The flaw carries a CVSS 3.1 score of 7.8 and is associated with CWE-404.
A local attacker with low privileges can exploit the weakness without user interaction to elevate rights on the target system, resulting in high impact to confidentiality, integrity, and availability.
Microsoft has published security guidance for the issue at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8405, along with related tracking entries at the listed SecurityFocus and SecurityTracker URLs.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-20043
Vulnerability details
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1,…
more
Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.
- CWE(s)
- KEV Date Added
- 28 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates improper kernel memory object handling in DXGKRNL that enables the described local privilege escalation.
Enforces least-privilege boundaries so a low-privileged local process cannot obtain the elevated rights the CVE permits.
Ensures the operating system enforces access-control decisions that the DXGKRNL flaw would otherwise bypass.