Company confirms “important” vulnerability on Windows 7

Mar 30, 2018 05:33 GMT  ·  By

Microsoft has recently rolled out Windows 7 and Windows Server 2008 R2 update KB4100480 to address a vulnerability introduced by the original Meltdown patch shipped in January this year.

As reported this year, security researcher Ulf Frisk has discovered that the Meltdown update for Windows 7 allowed attackers to gain memory read and write rights at high speeds, with a successful exploit eventually providing a malicious actor with full control over a machine.

Microsoft documented the vulnerability in CVE-2018-1038 and assigned it an important severity rating. No attacks have been spotted in the wild, Microsoft says, but users are recommended to patch their systems as soon as possible.

“An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode,” Microsoft explains.

Windows 10 not vulnerable

“An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system. The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.”

The vulnerability only exists in Windows 7, and all the other versions of the operating system are fully protected. Also, since the flaw was introduced by the Meltdown patch released in January, computers that are running on the December 2017 security update level aren’t affected.

Microsoft has addressed the flaw with the March 2018 Patch Tuesday rollout, so up-to-date systems aren’t vulnerable either. Windows 8.1 and Windows 10 are also protected.

The new patch is shipped via Windows Update on targeted Windows 7 systems, but it can also be downloaded manually from the Microsoft’s Update Catalog here.