Microsoft Windows - POP/MOV SS Privilege Escalation Exploit

🗓️ 23 May 2018 00:00:00Reported by Can BölükType

zdt🔗 0day.today👁 120 Views

Microsoft Windows POP SS Privilege Escalation Exploit CVE-2018-889

Reporter	Title	Published	Views	Family All 489
0day.today	Microsoft Windows #MicrosoftWindows POP/MOV SS Local Privilege Elevation Exploit	13 Jul 201800:00	–	zdt
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities have been fixed in IBM Security Privileged Identity Manager Appliance.	17 Sep 201915:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities	18 Feb 201914:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities	3 Dec 201814:30	–	ibm
FreeBSD	FreeBSD -- Mishandling of x86 debug exceptions	8 May 201800:00	–	freebsd
Tenable Nessus	macOS 10.13.x < 10.13.5 Multiple Vulnerabilities	10 Apr 201900:00	–	nessus
Tenable Nessus	Amazon Linux 2 : kernel (ALAS-2018-1023)	30 May 201800:00	–	nessus
Tenable Nessus	Amazon Linux AMI : kernel (ALAS-2018-1023)	30 May 201800:00	–	nessus
Tenable Nessus	CentOS 7 : kernel (CESA-2018:1318)	31 May 201800:00	–	nessus
Tenable Nessus	CentOS 6 : kernel (CESA-2018:1319) (Meltdown)	10 May 201800:00	–	nessus

Demo exploitation of the POP SS vulnerability (CVE-2018-8897), leading to unsigned code execution with kernel privilages.
 
- KVA Shadowing should be disabled and the relevant security update should be uninstalled.
- This may not work with certain hypervisors (like VMWare), which discard the pending #DB after INT3.
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/44697.zip

#  0day.today [2018-05-23]  #

23 May 2018 00:00Current

7.3High risk

Vulners AI Score7.3

EPSS0.24723