CVE-2018-1038General(microsoft / windows_7)

One of the most fascinating bugs in Windows wasn't even in "win32k.sys", it was Double Fetch (CVE-2018-1038) - https://blog.xpnsec.com/total-meltdown-cve-2018-1038/ The kernel validated a user-supplied value, then fetched it again later assuming it hadn't changed. An attacker could race another thread to modify the value between the two accesses, turning a perfectly valid request into an invalid one after the check had already passed.

CVE-2018-1038 (Total Meltdown) is an interesting case study in Windows virtual memory. A flaw introduced during Microsoft's Meltdown mitigation for Windows 7 x64 and Windows Server 2008 R2 x64 left kernel memory mapped with incorrect page table permissions. As a result, unprivileged processes could access kernel memory, breaking the isolation between user and kernel space. It's a great example of how a single page table permission bit can undermine OS security.

27d950456e063ae8f2d10010b896493d ac52b868ee0c57812c5bd2c937c7a2d9 75615d77ab91703a6506f9c0368d582d muixvaq[.]cn 211[.]154[.]27[.]66:555 103[.]120[.]88[.]107:90 AS146817 Hubei Feixun Network Co., Ltd 🇨🇳 CVE-2018-1038: Total Meltdown side-channel information leak attempt #Blackmoon