Windows 7 and Windows Server 2008 R2 x64 fail to protect kernel memory when the Microsoft update for meltdown is installed

Overview

When the Microsoft update for meltdown is installed on a Windows 7 x64 or Windows Server 2008 R2 x64 system, an unprivileged process may be able to read and write the entire memory space available to the Windows kernel.

Description

The update that Microsoft has released for meltdown on x64 versions of Windows 7 and Windows Server 2008 R2 incorrectly sets the permission bit for memory accessible from unprivileged user space. As a result, such platforms that have the meltdown update installed, which was released in January 2018 will not properly protect the contents of system memory…

---

Impact

An attacker with the ability to run code on an affected platform as an unprivileged user may be able to read from and write to the entire contents of system memory. Exploit code that uses this vulnerability to escalate privileges from an unprivileged user to SYSTEM privileges is publicly available.

---

Solution

Apply an update

This issue is addressed in the Microsoft update for CVE-2018-1038.

---

Vendor Information

277400

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Affected

Updated: March 29, 2018

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1038&gt;

CVSS Metrics

Group	Score	Vector
Base	6.8	AV:L/AC:L/Au:S/C:C/I:C/A:C
Temporal	5.9	E:H/RL:OF/RC:C
Environmental	5.9	CDP:ND/TD:H/CR:ND/IR:ND/AR:ND

References

• <http://blog.frizk.net/2018/03/total-meltdown.html&gt;
• <https://blog.xpnsec.com/total-meltdown-cve-2018-1038/&gt;
• <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1038&gt;

Acknowledgements

This vulnerability was publicly reported by Ulf Frisk.

This document was written by Will Dormann.

Other Information

CVE IDs:	CVE-2018-1038
Date Public:	2018-03-27 Date First Published: