CVE-2018-8405

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi Dipakai ransomware EPSS 3,4%

Kerentanan Improper Resource Shutdown or Release pada microsoft windows 10 1507, microsoft windows 10 1607 +9 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 28 Maret 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.

Rincian

Terbit di NVD

15 Agustus 2018

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-404: Improper Resource Shutdown or Release

EPSS (30 hari)

3,4% peluang dieksploitasi; lebih tinggi dari 88,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability

Masuk KEV

28 Maret 2022

Tenggat CISA

18 April 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8405 patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8405 pemerintah AS
• http://www.securityfocus.com/bid/105011 broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1041461 broken link · advisory pihak ketiga · vdb entry