Security restrictions bypass in Microsoft Windows Device Guard

Published: 2018-08-14

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2018-8204 CVE-2018-8200
CWE-ID	CWE-94
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	Windows Operating systems & Components / Operating system Windows Server Operating systems & Components / Operating system
Vendor	Microsoft

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Code injection

EUVDB-ID: #VU14405

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-8204

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a local attacker to bypass security restrictions on the target system.

The vulnerability exists due to an error when PowerShell exposes functions and processes user supplied code. A local attacker can inject code into a trusted PowerShell process to bypass the Device Guard Code Integrity policy on the local machine.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Windows: 10

Windows Server: 2016

External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8204

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Code injection

EUVDB-ID: #VU14406