Main Vulnerability Database Vulnerabilities #VU8327

Security restrictions bypass in Microsoft Windows and Windows Server - CVE-2017-8746

Published: September 12, 2017 / Updated: September 12, 2017

Vulnerability identifier: #VU8327

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-8746

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to bypass security restrictions on the target system.

The vulnerability exists due to an error in Device Guard. A local attacker can inject code into a trusted PowerShell process that is trusted by the Code Integrity policy and bypass the Device Guard Code Integrity policy on the local machine.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2017-8746

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8746

Related Security Bulletins