CVE-2018-8405
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
Description
CVE-2018-8405 is a privilege escalation vulnerability in the Microsoft DirectX Graphics Kernel (DXGKRNL) driver that allows a locally authenticated attacker to execute arbitrary code with elevated SYSTEM privileges. Similar to CVE-2018-8406, this vulnerability arises from improper handling of objects in memory by the DXGKRNL.sys kernel driver during graphics processing operations. CISA added CVE-2018-8405 to the Known Exploited Vulnerabilities catalog on March 28, 2022, confirming active exploitation. The EPSS score of 0.064% (31.0th percentile) reflects a lower exploitation probability, though the KEV listing confirms real-world use in attack chains.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 1709 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 2012 | r2 |
| microsoft | windows server 2016 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/105011(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1041461(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8405(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8405(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes a weakness where software does not properly manage privilege boundaries, allowing attackers to gain elevated access to protected resources. In CVE-2018-8405, the DirectX Graphics Kernel driver (DXGKRNL.sys) improperly handles objects in memory, creating a condition that a local attacker can exploit to escalate from standard user privileges to SYSTEM-level access.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2018-8405 enables local privilege escalation to SYSTEM level through the DirectX Graphics Kernel driver, providing an attacker with complete control over the affected Windows system. The kernel-mode nature of the vulnerability means successful exploitation breaks through the user-kernel security boundary, granting access to all system resources, protected files, credential stores, and the ability to disable security software. While the attack requires local access, it is a powerful escalation primitive that can transform a limited user-mode compromise into a full system takeover. The combination of kernel-level impact and confirmed active exploitation makes this a high-priority patching target for any unpatched Windows environment.
Exploit Maturity
CVE-2018-8405 is confirmed as actively exploited in the wild by CISA through its KEV catalog listing on March 28, 2022. The EPSS score of 0.064% (31.0th percentile) indicates relatively lower exploitation probability compared to remotely exploitable vulnerabilities, which is consistent with the local attack vector requirement. However, the KEV confirmation demonstrates that threat actors have successfully incorporated this vulnerability into post-compromise operations to achieve SYSTEM-level access on Windows targets.
Remediation
- Apply the Microsoft security update from August 2018 (Patch Tuesday) that addresses CVE-2018-8405 in the DirectX Graphics Kernel driver.
- Ensure all Windows systems are enrolled in automatic Windows Update for timely delivery of security patches addressing known exploited vulnerabilities.
- Implement endpoint detection and response (EDR) solutions with kernel-level monitoring capabilities to detect DirectX driver exploitation attempts.
- Enforce the principle of least privilege across all endpoints, restricting local logon rights and administrative access to minimize privilege escalation opportunities.
Technical Details
CVE-2018-8405 is a local privilege escalation vulnerability in the Windows DirectX Graphics Kernel (DXGKRNL.sys) driver caused by improper handling of objects in memory. The DXGKRNL.sys driver operates at kernel privilege level and processes DirectX graphics API calls from user-mode applications. The vulnerability allows a local attacker to craft specific DirectX API interactions that trigger the improper memory object handling, corrupting kernel data structures in a way that enables redirection of execution flow to attacker-controlled code running with SYSTEM privileges. The attack complexity is low and requires no user interaction beyond the attacker's own local session.
Frequently Asked Questions
Is CVE-2018-8405 being actively exploited?
Yes, CVE-2018-8405 is confirmed as actively exploited in the wild by CISA, which added it to the KEV catalog on March 28, 2022. While the EPSS score is 0.064% (31.0th percentile), the KEV listing confirms real-world exploitation in post-compromise attack scenarios.
What systems are affected by CVE-2018-8405?
CVE-2018-8405 affects Windows systems running the vulnerable DirectX Graphics Kernel driver (DXGKRNL.sys), including Windows 10 and Windows Server editions available at the time of the August 2018 disclosure. All unpatched systems are vulnerable.
How do I fix CVE-2018-8405?
Apply the Microsoft security update from the August 2018 Patch Tuesday. Ensure Windows Update is enabled for automatic security updates. Deploy EDR solutions with kernel monitoring to detect exploitation attempts.
How severe is CVE-2018-8405?
CVE-2018-8405 is a significant local privilege escalation vulnerability in a Windows kernel driver that enables SYSTEM-level access. While it requires local access, it is confirmed exploited in the wild and can enable complete system compromise when combined with an initial access vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.