CVE-2018-8222HighCVSS 5.3

Device Guard Code Integrity Policy Security Feature Bypass Vulnerability

Published
July 10, 2018
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2018-8222 →

📋 Description

A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session. An attacker who successfully exploited this vulnerability could inject code into a trusted PowerShell process to bypass the Device Guard Code Integrity policy on the local machine. To exploit the vulnerability, an attacker would first have to access the local machine, and then inject malicious code into a script that is trusted by the Code Integrity policy. The injected code would then run with the same trust level as the script and bypass the Code Integrity policy. The update addresses the vulnerability by correcting how PowerShell exposes functions and processes user supplied code.

🎯 Affected products14

  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1703 for 32-bit Systems
  • Windows 10 Version 1703 for x64-based Systems
  • Windows 10 Version 1709 for 32-bit Systems
  • Windows 10 Version 1709 for x64-based Systems
  • Windows 10 Version 1803 for 32-bit Systems
  • Windows 10 Version 1803 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • Windows Server, version 1709 (Server Core Installation)
  • Windows Server, version 1803 (Server Core Installation)

✅ Remediation

KB4338826 (Security Update) KB4345419 (Alternate Cumulative) KB4338819 (Security Update) KB4345421 (Alternate Cumulative) KB4338825 (Security Update) KB4345420 (Alternate Cumulative) KB4338829 (Security Update) KB4345455 (Alternate Cumulative) KB4338814 (Security Update) KB4345418 (Alternate Cumulative)

🔗 References (11)