cbcvebase.
CVE-2018-8453
published 2018-10-10

CVE-2018-8453: An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of…

PriorityP188high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-07-21
Exploited in the wild
EPSS
69.83%
99.3th percentile
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Affected

49 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10_servers
microsoftwindows_10_servers
microsoftwindows_7
microsoftwindows_7
microsoftwindows_8.1
microsoftwindows_8.1
microsoftwindows_rt_8.1
microsoftwindows_server_2008
microsoftwindows_server_2008
microsoftwindows_server_2008
microsoftwindows_server_2008
microsoftwindows_server_2008
microsoftwindows_server_2008

Detection & IOCsextracted from sources · hover to see the quote

commandNtUserSetWindowFNID
  • Detect exploitation of CVE-2018-8453 by monitoring for usermode hooks placed on KernelCallbackTable entries for fnDWORD, fnNCDESTROY, and fnINLPCREATESTRUCT — a hallmark of this exploit's setup phase.
  • Monitor for Token-stealing shellcode patterns that swap the current process Token with the SYSTEM EPROCESS token following a win32k.sys Use-After-Free exploitation sequence.
  • Hunt for malware payloads encrypted with AES-256-CBC keyed on the SHA-1 of the SMBIOS UUID, stored as a randomly named file in the Windows directory — a persistence technique used by the FruityArmor implant delivered via this exploit.
  • Detect anomalous use of Microsoft BITS (Background Intelligent Transfer Service) for C2 communications, as the FruityArmor implant delivered via this exploit uses BITS as its C2 channel.
  • Flag processes that store a payload as a randomly named file in the Windows directory and locate it by comparing a hash of every filename in that directory — indicative of the FruityArmor loader behavior.
  • In Sodin/REvil samples, check the configuration block field 'exp' to determine whether the CVE-2018-8453 exploit is enabled; presence of this field set to true indicates active privilege escalation via win32k.sys.
  • Kaspersky AV verdicts HEUR:Exploit.Win32.Generic, HEUR:Trojan.Win32.Generic, and PDM:Exploit.Win32.Generic are associated with artifacts from CVE-2018-8453 exploitation campaigns.
  • ·The FruityArmor implant payload is encrypted with AES-256-CBC using the SHA-1 of the victim machine's SMBIOS UUID as the key, making static decryption impossible without the specific victim's UUID — sandbox detonation on the original victim hardware or UUID extraction is required.
  • ·The exploit's heap spray procedure varies by Windows version; it includes five separate spray functions, with the Windows 10 RS4 variant using bitmap objects of varying sizes to exhaust the Low Fragmentation Heap allocator — detection logic must account for version-specific spray patterns.
  • ·Sodin/REvil's CVE-2018-8453 exploit is embedded in a 32-bit executable and uses the Heaven's Gate technique to execute 64-bit shellcode; analysis tools that do not handle mixed 32/64-bit code may miss the exploit logic.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
cisa7.8HIGH
vendor_msrc7.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.