New Search

Device Guard Code Integrity Policy Security Feature Bypass Vulnerability - CVE-2018-8492

oval:org.cisecurity:def:6017

A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session. An attacker who successfully exploited this vulnerability could inject code into a trusted PowerShell process to bypass the Device Guard Code Integrity policy on the local machine. To exploit the vulnerability an attacker would first have to access the local machine and then inject malicious code into a script that is trusted by the Code Integrity policy. The injected code would then run with the same trust level as the script and bypass the Code Integrity policy. The update addresses the vulnerability by correcting how PowerShell exposes functions and processes user supplied code.

Family:
windows
Status:
ACCEPTED
Platform(s):
  • Microsoft Windows Server 2016
  • Microsoft Windows 10
  • Microsoft Windows Server 2019
Class:
vulnerability
Reference(s):
  • CVE-2018-8492
  • MSRC-CVE-2018-8492
  • KB4462917
  • KB4462937
  • KB4462918
  • KB4462919
  • KB4464330
Product(s):