Since the beginning of 2018, Processor manufacturers have been affected by Meltdown / Spectre vulnerabilities, with the Operating System Developers been trying to patch it up using the conventional methods, till the Processor manufacturers themselves do not patch up their vulnerabilities.
Microsoft, in March, had provided a patch to mitigate Meltdown Vulnerability, however, in doing so, it introduced a bug into the system, which allowed any rogue user-space application to access the Kernel Memory Areas and subsequently leading to Privilege Escalation.
About CVE-2018-1038
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.
The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.
Vulnerability details
| Vulnerability Category | Vulnerability Impact | Severity | CVE Number |
| Kernel Exploit | Local Privilege Escalation. | Important | CVE-2018-1038 |
Affected Product Versions and Patch Downloads
| Product | Article | Patch Download |
| Windows 7 for x64-based Systems Service Pack 1 | 4100480 | Security Update |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 4100480 | Security Update |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 4100480 | Security Update |
