Attacker Value
Moderate
(1 user assessed)
Exploitability
Moderate
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Local
3

CVE-2021-33739

Disclosure Date: June 08, 2021 •
CVE-2021-33739 CVSS v3 Base Score: 8.4
Exploited in the Wild
Reported by gwillcox-r7 and 1 more...
View Source Details
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Add Assessment

2
Ratings
  • Attacker Value
    Medium
  • Exploitability
    Medium
Common in enterpriseGives privileged accessVulnerable in default configurationAuthenticated
Technical Analysis

Public PoC code has been supposively making the rounds courtesy of https://github.com/mavillon1/CVE-2021-33739-POC. There is also a detailed writeup on this issue at https://mp.weixin.qq.com/s/ZjJ4kXOCTSez2erVKYzKbg although it is in Chinese so you will need to translate it.

From the translation it seems this was originally discovered as being exploited in the wild by Shadow Lab in May 2021, and then they worked with Anheng Threat Intelligence Center to notify MSRC, who then patched the bug in the June 2021 patch release. The vulnerability is located in dwmcore.dll, which is the core DLL for DWM, aka the Desktop Windows Manager, on Windows machines. More specifically, its a UAF caused by an reference count tracking issue of the Tracker Binding Manager object. Its interesting also to note that they state this vulnerability only affects Windows 10 machines and does not affect Windows 8.1 and below; this is reflected in Microsoft’s advisory as well.

To trigger the vulnerability, one needs to “create a CinteractionTrackerBindingManagerMarshaler(0x59) resource and a CinteractionTrackerMarshaler(0x58) resource at the code level, and bind the same CinteractionTrackerMarshaler resource as resource1_id and resource2_id to the CinteractionTrackerBindingManagerMarshaler, and do not manually release the CinteractionTrackerBindingManagerMarshaler resource.”. I won’t discuss it further as the technical details are in the original writeup though but this should provide a brief overview for those interested.

The conclusion of this writeup notes that technically this vulnerability falls within the scope of Windows DirectComposition component, which has seen increased attacks over the last two years. It also notes that this may have ties to the release of the Win32k Dark: Attacking The Shadow Part of Graphic Subsystem presentation at the Cansecwest 2017 conference, where researchers discussed how to attack Windows DirectComposition in more detail.

Log in to Add Reply
CVSS V3 Severity and Metrics
Base Score:
8.4 High
Impact Score:
5.9
Exploitability Score:
2.5
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
Windows 10 Version 1909 10.0.18363.1621
Windows 10 Version 21H1 10.0.19043.1052
Windows 10 Version 2004 10.0.19041.1052
Windows Server version 2004 10.0.19041.1052
Windows 10 Version 20H2 10.0.19042.1052
Windows Server version 20H2 10.0.19042.1052
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • microsoft

Products

  • windows 10 1909,
  • windows 10 2004,
  • windows 10 20h2,
  • windows 10 21h1,
  • windows server 2004,
  • windows server 20h2

Exploited in the Wild

Reported by:

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis