Attacker Value
Moderate
(1 user assessed)
Exploitability
Moderate
(1 user assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
2

CVE-2021-33739

Disclosure Date: June 08, 2021
Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Add Assessment

2
Ratings
Technical Analysis

Public PoC code has been supposively making the rounds courtesy of https://github.com/mavillon1/CVE-2021-33739-POC. There is also a detailed writeup on this issue at https://mp.weixin.qq.com/s/ZjJ4kXOCTSez2erVKYzKbg although it is in Chinese so you will need to translate it.

From the translation it seems this was originally discovered as being exploited in the wild by Shadow Lab in May 2021, and then they worked with Anheng Threat Intelligence Center to notify MSRC, who then patched the bug in the June 2021 patch release. The vulnerability is located in dwmcore.dll, which is the core DLL for DWM, aka the Desktop Windows Manager, on Windows machines. More specifically, its a UAF caused by an reference count tracking issue of the Tracker Binding Manager object. Its interesting also to note that they state this vulnerability only affects Windows 10 machines and does not affect Windows 8.1 and below; this is reflected in Microsoft’s advisory as well.

To trigger the vulnerability, one needs to “create a CinteractionTrackerBindingManagerMarshaler(0x59) resource and a CinteractionTrackerMarshaler(0x58) resource at the code level, and bind the same CinteractionTrackerMarshaler resource as resource1_id and resource2_id to the CinteractionTrackerBindingManagerMarshaler, and do not manually release the CinteractionTrackerBindingManagerMarshaler resource.”. I won’t discuss it further as the technical details are in the original writeup though but this should provide a brief overview for those interested.

The conclusion of this writeup notes that technically this vulnerability falls within the scope of Windows DirectComposition component, which has seen increased attacks over the last two years. It also notes that this may have ties to the release of the Win32k Dark: Attacking The Shadow Part of Graphic Subsystem presentation at the Cansecwest 2017 conference, where researchers discussed how to attack Windows DirectComposition in more detail.

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • microsoft

Products

  • windows 10 1909,
  • windows 10 2004,
  • windows 10 20h2,
  • windows 10 21h1,
  • windows server 2016 2004,
  • windows server 2016 20h2

Exploited in the Wild

Reported by:

Additional Info

Technical Analysis