CVE Vulnerabilities

CVE-2018-0901

Missing Release of Memory after Effective Lifetime

Published: Mar 14, 2018 | Modified: May 23, 2022
CVSS 3.x
4.7
MEDIUM
Source:
NVD
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
1.9 LOW
AV:L/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way memory addresses are handled, aka Windows Kernel Information Disclosure Vulnerability. This CVE is unique from CVE-2018-0811, CVE-2018-0813, CVE-2018-0814, CVE-2018-0894, CVE-2018-0895, CVE-2018-0896, CVE-2018-0897, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900, and CVE-2018-0926.

Weakness

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

Affected Software

Name Vendor Start Version End Version
Windows_10 Microsoft - -
Windows_10 Microsoft 1511 1511
Windows_10 Microsoft 1607 1607
Windows_10 Microsoft 1703 1703
Windows_10 Microsoft 1709 1709
Windows_7 Microsoft - -
Windows_8.1 Microsoft - -
Windows_rt_8.1 Microsoft - -
Windows_server Microsoft 1709 1709
Windows_server_2008 Microsoft - -
Windows_server_2008 Microsoft r2 r2
Windows_server_2012 Microsoft * *
Windows_server_2012 Microsoft r2 r2
Windows_server_2016 Microsoft - -

Potential Mitigations

  • Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
  • For example, glibc in Linux provides protection against free of invalid pointers.
  • When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
  • To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.

References