vulnwire
4.7med

CVE-2016-3258

Race condition in the kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
4.7
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 61%
Public exploits
0
none known

Race condition in the kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to bypass the Low Integrity protection mechanism and write to files by leveraging unspecified object-manager features, aka "Windows File System Security Feature Bypass."

Exploit prediction (EPSS)

0.93% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.04.7CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD2.01.2AV:L/AC:H/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

  • securityfocus.com /bid/91606 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1036289 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2016/ms16-092 · vendor-advisory, x_refsource_MS, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.