CVE-2018-8224
Microsoft Windows Server 2008
HIGH 7.0
At a glance
- Source
- NVD
- EPSS
- EPSS 1.15 % · percentile 67 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- microsoft
- NVD status
- Modified
Description
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.
Weaknesses (CWE)
- CWE-404 — Improper Resource Shutdown or Release
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.0 | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-19893
- GCVE · GCVE-0-2018-8224
CERT-FR advisories
- CERTFR-2018-AVI-286 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Microsoft · Windows Server 2008 | affected 32-bit Systems Service Pack 2 ; affected 32-bit Systems Service Pack 2 (Server Core installation) ; affected Itanium-Based Systems Service Pack 2 ; affected x64-based Systems Service Pack 2 ; affected x64-based Systems Service Pack 2 (Server Core installation) |
| Microsoft · Windows 7 | affected 32-bit Systems Service Pack 1 ; affected x64-based Systems Service Pack 1 |
| Microsoft · Windows Server 2008 R2 | affected Itanium-Based Systems Service Pack 1 ; affected x64-based Systems Service Pack 1 ; affected x64-based Systems Service Pack 1 (Server Core installation) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |