7.8high
CVE-2018-8440KEV · ransomwarein critical feed1 exploit
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.1 · CNA
CISA KEV
Yes
added 2022-03-28
EPSS
18.5%
percentile 97%
Public exploits
1
Metasploit
Summary
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Known exploited (CISA KEV)
- Added
- 4 y ago
- Due date
- 2022-04-18 (4 y ago)
- Ransomware use
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor / product
- Microsoft / Windows
- CISA name
- Microsoft Windows Privilege Escalation Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction (EPSS)
18.53% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
Exploits and detections
- Metasploit exploit/windows/local/alpc_taskscheduler Microsoft Windows ALPC Task Scheduler Local Privilege Elevation · metasploit exploit, normal rank · 2018-08-27
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Microsoft Windows 7
- Microsoft Windows Server 2012 R2
- Microsoft Windows RT 8.1
- Microsoft Windows Server 2008
- Microsoft Windows Server 2012
- Microsoft Windows 8.1
- Microsoft Windows Server 2016
- Microsoft Windows Server 2008 R2
- Microsoft Windows 10
- Microsoft Windows 10 Servers
References
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-8440 · x_refsource_CONFIRM, x_transferred
- blog.0patch.com /2018/09/comparing-our-micropatch-with.html · x_refsource_MISC, x_transferred
- blog.0patch.com /2018/08/how-we-micropatched-publicly-dropped.html · x_refsource_MISC, x_transferred
- securitytracker.com /id/1041578 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/105153 · vdb-entry, x_refsource_BID, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8440 · government-resource
Sources
- CVE List: CVE-2018-8440
- NVD: CVE-2018-8440
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.