CVE-2018-8611
Published: 12 December 2018
Summary
CVE-2018-8611 is a high-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 5.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2018-8611 is an elevation of privilege vulnerability in the Windows kernel that arises when the kernel fails to properly handle objects in memory. It affects a wide range of Windows client and server versions, including Windows 7, Windows 8.1, Windows 10, Windows RT 8.1, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019.
A local attacker with low privileges can exploit the flaw without user interaction to obtain full elevation of privilege on the affected system, resulting in complete compromise of confidentiality, integrity, and availability as reflected in its CVSS 7.8 score.
Microsoft has published guidance and patches through its Security Response Center advisory for CVE-2018-8611. The vulnerability is also tracked in the CISA Known Exploited Vulnerabilities catalog, confirming observed real-world exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-20226
Vulnerability details
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server…
more
2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
- CWE(s)
- KEV Date Added
- 24 May 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of vendor patches that Microsoft released to correct the kernel memory-handling flaw.
Mandates memory-protection mechanisms that would block or contain the improper object handling exploited for elevation of privilege.
Enforces separate execution domains for processes, limiting the ability of a low-privileged process to corrupt kernel objects and escalate.