Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Microsoft Windows - 'POP/MOV SS' Privilege Escalation

🗓️ 22 May 2018 00:00:00Reported by Can BölükType 
exploitdb
 exploitdb🔗 www.exploit-db.com👁 133 Views

Microsoft Windows - 'POP/MOV SS' Privilege Escalation vulnerability, unsigned code execution with kernel privilage

Related
Code
ReporterTitlePublishedViews
Family
0day.today		Microsoft Windows - POP/MOV SS Privilege Escalation Exploit
23 May 201800:00
–zdt
0day.today		Microsoft Windows #MicrosoftWindows POP/MOV SS Local Privilege Elevation Exploit
13 Jul 201800:00
–zdt
IBM Security Bulletins		Security Bulletin: Multiple Security Vulnerabilities have been fixed in IBM Security Privileged Identity Manager Appliance.
17 Sep 201915:34
–ibm
IBM Security Bulletins		Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities
18 Feb 201914:10
–ibm
IBM Security Bulletins		Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities
3 Dec 201814:30
–ibm
FreeBSD		FreeBSD -- Mishandling of x86 debug exceptions
8 May 201800:00
–freebsd
Tenable Nessus		macOS 10.13.x < 10.13.5 Multiple Vulnerabilities
10 Apr 201900:00
–nessus
Tenable Nessus		Amazon Linux 2 : kernel (ALAS-2018-1023)
30 May 201800:00
–nessus
Tenable Nessus		Amazon Linux AMI : kernel (ALAS-2018-1023)
30 May 201800:00
–nessus
Tenable Nessus		CentOS 7 : kernel (CESA-2018:1318)
31 May 201800:00
–nessus
Rows per page
Demo exploitation of the POP SS vulnerability (CVE-2018-8897), leading to unsigned code execution with kernel privilages.

- KVA Shadowing should be disabled and the relevant security update should be uninstalled.
- This may not work with certain hypervisors (like VMWare), which discard the pending #DB after INT3.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44697.zip

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
22 May 2018 00:00Current
7.3High risk
Vulners AI Score7.3
CVSS 27.2
CVSS 37.8
EPSS0.24723
microsoft windowsprivilege escalationvulnerabilityunsigned codekernel privilegeskva shadowingsecurity updatehypervisorsvmware#dbint3
133