CVE-2018-8276HighCVSS 4.3

Scripting Engine Security Feature Bypass Vulnerability

Published
July 10, 2018
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2018-8276 →

📋 Description

A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed. By itself, the CFG bypass vulnerability does not allow arbitrary code execution. However, an attacker could use the CFG bypass vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability, to run arbitrary code on a target system. To exploit the CFG bypass vulnerability, a user must be logged on to the Microsoft Chakra scripting engine and running it. The user would then need to browse to a malicious website. The security update addresses the CFG bypass vulnerability by helping to ensure that the Microsoft Chakra scripting engine properly handles accessing memory.

🎯 Affected products7

  • ChakraCore
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for 32-bit Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for x64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for 32-bit Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1709 for x64-based Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for 32-bit Systems
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1803 for x64-based Systems

✅ Remediation

KBCommit (Security Update) KB4338826 (Security Update) KB4345419 (Alternate Cumulative) KB4338819 (Security Update) KB4345421 (Alternate Cumulative) KB4338825 (Security Update) KB4345420 (Alternate Cumulative)

🔗 References (8)