CVE-2016-0181
Hypervisor Code Integrity Security Feature Bypass
CVE-2016-0181 is fixed in 4 products on 1 platform, first by KB3156421, released May 10, 2016. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
n/a
Important
Exploitation
None reported
Exploitation Unlikely
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0152
74th percentile
<p>A security feature bypass vulnerability exists when Windows incorrectly allows certain kernel-mode pages to be marked as Read, Write, Execute (RWX) even with <a href="https://technet.microsoft.com/en-us/library/security/dn848375.aspx#HVCI">Hypervisor Code Integrity (HVCI)</a> enabled.</p> <p>To exploit this vulnerability, an attacker could run a specially crafted application to bypass code integrity protections in Windows.</p> <p>The security update addresses the vulnerability by correcting security feature behavior to preclude the incorrect marking of RWX pages under HVCI.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Microsoft | |||
| Windows 10 Version 1511 for 32-bit Systems | 10586.318 | KB3156421 | May 10, 2016 |
| Windows 10 Version 1511 for x64-based Systems | 10586.318 | KB3156421 | May 10, 2016 |
| Windows 10 for 32-bit Systems | 10240.16854 | KB3156387 | May 10, 2016 |
| Windows 10 for x64-based Systems | 10240.16854 | KB3156387 | May 10, 2016 |