Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-8584 — Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft Windows 10

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition7 documents6 sources
Severity
7.8HIGHNVD
EPSS
4.5%
top 10.86%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
4
Microsoft Windows 10Microsoft Windows 10 ServersMicrosoft Windows Server 2016+1 more
Timeline
PublishedNov 14
Latest updateMay 13

Description

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5microsoft/windows_10_serversversion 1709 (Server Core Installation), version 1803 (Server Core Installation)+1
▶CVEListV5microsoft/windows_server_2016(Server Core installation)
▶CVEListV5microsoft/windows_server_2019(Server Core installation)
▶NVDmicrosoft/windows1709, 1803+1
▶CVEListV5microsoft/windows_1015 versions+14

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-cp85-4pfj-f5qq: An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevat↗2022-05-13
▶
CVEList
CVE-2018-8584: An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevat↗2018-11-14
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows - DSSVC CheckFilePermission Arbitrary File Deletion↗2019-01-09
▶

📋Vendor Advisories

1
Microsoft
Windows ALPC Elevation of Privilege Vulnerability↗2018-11-13
▶

🕵️Threat Intelligence

1
Tenable
Microsoft Data Sharing Service Zero-Day Exploit Released on Twitter (CVE-2018-8584)↗2018-10-24
▶
CVE-2018-8584 — Microsoft Windows 10 vulnerability | cvebase