The Microsoft Windows Kernel Transaction Manager (KTM) is vulnerable to a race condition because it fails to properly handle objects in memory, which can result in local privilege escalation.
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') - CVE-2018-8611
According to Microsoft, the Windows kernel fails "to properly handle objects in memory". A successful attacker could run arbitrary code in kernel mode, and then "install programs; view, change, or delete data; or create new accounts with full user rights."
After logging into the system, an attacker could run a maliciously crafted application to exploit the race condition. They could then elevate their local privileges, create user accounts, install new programs, or change, view, or delete data.
Apply an update
Thanks to researchers Boris Larin and Igor Soumenkov from Kaspersky Lab for reporting this vulnerability to Microsoft.
This document was written by Madison Oliver.
|Date First Published:||2019-01-04|
|Date Last Updated:||2019-01-24 17:58 UTC|