Bug 1576633 (CVE-2018-1039)

Summary:	CVE-2018-1039 dotnet: Device Guard security bypass can allow for privilege escalation
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bgollahe, bodavis, dbhole, kanderso, lzachar, omajid, rwagner, sfowler
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-09-27 10:07:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1576634

Description Sam Fowler 2018-05-10 02:07:01 UTC

A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability could circumvent a User Mode Code Integrity (UMCI) policy on the machine.

To exploit the vulnerability, an attacker would first have to access the local machine, and then run a malicious program.


External References:

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1039

Comment 4 Stefan Cornelius 2019-09-27 10:07:38 UTC

Statement:

The User Mode Code Integrity (UMCI) and Device Guard features are specific to certain versions of the Microsoft Windows operating system and not available with Red Hat Enterprise Linux.