vulnwire
7.0high

CVE-2018-07431 exploit

Windows Subsystem for Linux in Windows 10 version 1703, Windows 10 version 1709, and Windows Server, version 1709 allows an elevation of pr…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.9%
percentile 87%
Public exploits
1
Exploit-DB

Windows Subsystem for Linux in Windows 10 version 1703, Windows 10 version 1709, and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows Subsystem for Linux Elevation of Privilege Vulnerability".

Exploit prediction (EPSS)

2.87% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.

Exploits and detections

  • EDB-43962 Microsoft Windows Subsystem for Linux - 'execve()' Local Privilege Escalation · local · 2018-02-02

CVSS scores

Assigned byVersionScoreVector
NVD3.07.0CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.04.4AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Microsoft Corporation Windows Subsystem for Linux

References

  • securitytracker.com /id/1040094 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • github.com /saaramar/execve_exploit · x_refsource_MISC, x_transferred
  • twitter.com /AmarSaar/status/948892321755598848 · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/43962/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-0743 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/102350 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.