High
CVE-2021-33771
CVE-2021-33771
Add Assessment
Technical Analysis
Update: Looks like this was used by the exploit brokerage company Candiru along with CVE-2021-31979 to deliver spyware to targeted users, which according to Microsoft’s blog post, affected at least 100 victims in Palestine, Israel, Iran, Lebanon, Yemen, Spain, United Kingdom, Turkey, Armenia, and Singapore. Victims include human rights defenders, dissidents, journalists, activists, and politicians.
Hmm interesting so this bug only affects Windows 8.1 and later according to https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33771, despite also being disclosed in the same month as CVE-2021-31979, another bug that affected everything from Windows 7 and later onwards. Both bugs however affect the Windows Kernel and are being actively exploited in the wild for LPE.
There is little information on what actually is the issue here, although https://twitter.com/mavillon1/status/1415149124064878593/ suggests that MiFlashDataSecton, EtwpUpdatePeriodicCaptureState and AlpcpProcessSynchronousRequest may be possible culprits and reviewing AlpcpProcessSynchronousRequest shows that a potential integer overflow was fixed.
Given that Microsoft also lists the attack complexity for both vulnerabilities as Low it seems likely that other researchers will find a way to replicate these vulnerabilities and create working PoCs for them, particularly given that they have been exploited in the wild. Based on this evidence, it is highly recommended to patch these issues as soon as possible.
Further updates will be made to this post if and when these CVEs are tied to specific vulnerable functions.
Technical Analysis
Actors with local access are exploiting this vulnerability to execute code with elevated permission names.
Source: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-33771
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- windows 10 1507,
- windows 10 1607,
- windows 10 1809,
- windows 10 1909,
- windows 10 2004,
- windows 10 20h2,
- windows 10 21h1,
- windows 8.1 -,
- windows rt 8.1 -,
- windows server 2004,
- windows server 2008 -,
- windows server 2012 -,
- windows server 2016,
- windows server 2019,
- windows server 20h2
Exploited in the Wild
