CVE-2018-8406
Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability
Description
CVE-2018-8406 is a privilege escalation vulnerability in the Microsoft DirectX Graphics Kernel (DXGKRNL) driver that allows a locally authenticated attacker to elevate privileges to SYSTEM level by exploiting improper handling of objects in memory. The vulnerability exists in the DXGKRNL.sys kernel driver, which processes DirectX graphics operations and runs with elevated kernel privileges. CISA added CVE-2018-8406 to the Known Exploited Vulnerabilities catalog on March 28, 2022, confirming real-world exploitation. With an EPSS score of 0.064% (31.0th percentile), the vulnerability has a lower exploitation probability but remains a confirmed threat requiring patching.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | - |
| microsoft | windows 10 1607 | - |
| microsoft | windows 10 1703 | - |
| microsoft | windows 10 1709 | - |
| microsoft | windows 10 1803 | - |
| microsoft | windows server 1709 | - |
| microsoft | windows server 1803 | - |
| microsoft | windows server 2016 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/105012(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1041461(Broken Link, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8406(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8406(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CWE-269 describes a weakness where software does not properly manage privileges, enabling attackers to gain elevated access beyond their intended authorization. In CVE-2018-8406, the DirectX Graphics Kernel driver (DXGKRNL.sys) improperly handles objects in memory during graphics operations, allowing a local attacker to escalate from user-level to kernel-level privileges.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2018-8406 enables local privilege escalation through the DirectX Graphics Kernel driver, granting SYSTEM-level access on affected Windows systems. Successful exploitation allows an attacker to bypass user-level security controls, install persistent malware, access protected system files, and manipulate security logs. The kernel-level nature of the vulnerability means that exploitation compromises the entire trust boundary of the operating system, as kernel code runs with the highest privilege level available. While the local attack vector limits initial exploitation to scenarios where the attacker has already gained code execution, it significantly amplifies the impact of any initial compromise.
Exploit Maturity
CVE-2018-8406 is confirmed as actively exploited in the wild by CISA, which added it to the KEV catalog on March 28, 2022. The EPSS score of 0.064% (31.0th percentile) reflects relatively lower exploitation probability compared to remotely exploitable vulnerabilities, consistent with its local-only attack vector. Despite the lower EPSS score, the KEV listing confirms that this vulnerability has been used in real-world attacks as part of post-compromise escalation chains.
Remediation
- Apply the Microsoft security update from August 2018 (Patch Tuesday) that addresses CVE-2018-8406 in the DirectX Graphics Kernel driver across affected Windows versions.
- Ensure Windows Update is configured for automatic security updates to prevent delays in patching known exploited kernel vulnerabilities.
- Deploy endpoint detection and response (EDR) solutions capable of monitoring kernel-level activity and detecting anomalous DirectX driver behavior.
- Implement the principle of least privilege to limit the number of user accounts with local logon rights that could serve as starting points for privilege escalation.
Technical Details
CVE-2018-8406 is a local privilege escalation vulnerability in the Windows DirectX Graphics Kernel (DXGKRNL.sys) driver caused by improper handling of objects in memory during graphics kernel operations. The DXGKRNL.sys driver processes DirectX API calls from user-mode applications and runs at kernel privilege level, making it a high-value target for privilege escalation attacks. By crafting specific DirectX API calls that trigger the improper memory handling, a local attacker can corrupt kernel memory structures and redirect execution flow to achieve code execution with SYSTEM privileges. The attack vector is local with low complexity, requiring the attacker to have a user-mode foothold on the target system.
Frequently Asked Questions
Is CVE-2018-8406 being actively exploited?
Yes, CVE-2018-8406 is confirmed as actively exploited in the wild by CISA through its inclusion in the KEV catalog on March 28, 2022. Despite a lower EPSS score of 0.064%, the KEV listing confirms real-world exploitation as part of post-compromise attack chains.
What systems are affected by CVE-2018-8406?
CVE-2018-8406 affects Windows systems with the vulnerable DirectX Graphics Kernel driver (DXGKRNL.sys), including Windows 10 and Windows Server editions that were current at the time of disclosure in August 2018. All unpatched systems are vulnerable to local privilege escalation.
How do I fix CVE-2018-8406?
Apply the Microsoft security update from the August 2018 Patch Tuesday release. Ensure all Windows systems are enrolled in automatic Windows Update. Additionally, deploy EDR solutions to detect kernel-level exploitation attempts.
How severe is CVE-2018-8406?
CVE-2018-8406 is a significant local privilege escalation vulnerability in a Windows kernel driver. While it requires local access (limiting the initial attack surface), successful exploitation grants SYSTEM privileges, giving an attacker complete control over the compromised system. The KEV listing confirms it has been used in real attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.