Attacker Value
High
(2 users assessed)
Exploitability
High
(2 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
3

CVE-2021-33771

Disclosure Date: July 14, 2021
Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Privilege Escalation
Techniques
Validation
Validated

Description

Windows Kernel Elevation of Privilege Vulnerability

Add Assessment

2
Ratings
Technical Analysis

Update: Looks like this was used by the exploit brokerage company Candiru along with CVE-2021-31979 to deliver spyware to targeted users, which according to Microsoft’s blog post, affected at least 100 victims in Palestine, Israel, Iran, Lebanon, Yemen, Spain, United Kingdom, Turkey, Armenia, and Singapore. Victims include human rights defenders, dissidents, journalists, activists, and politicians.

Hmm interesting so this bug only affects Windows 8.1 and later according to https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33771, despite also being disclosed in the same month as CVE-2021-31979, another bug that affected everything from Windows 7 and later onwards. Both bugs however affect the Windows Kernel and are being actively exploited in the wild for LPE.

There is little information on what actually is the issue here, although https://twitter.com/mavillon1/status/1415149124064878593/ suggests that MiFlashDataSecton, EtwpUpdatePeriodicCaptureState and AlpcpProcessSynchronousRequest may be possible culprits and reviewing AlpcpProcessSynchronousRequest shows that a potential integer overflow was fixed.

Given that Microsoft also lists the attack complexity for both vulnerabilities as Low it seems likely that other researchers will find a way to replicate these vulnerabilities and create working PoCs for them, particularly given that they have been exploited in the wild. Based on this evidence, it is highly recommended to patch these issues as soon as possible.

Further updates will be made to this post if and when these CVEs are tied to specific vulnerable functions.

1
Ratings
  • Attacker Value
    High
  • Exploitability
    High
Technical Analysis

Actors with local access are exploiting this vulnerability to execute code with elevated permission names.
Source: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-33771

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • microsoft

Products

  • windows 10 -,
  • windows 10 1607,
  • windows 10 1809,
  • windows 10 1909,
  • windows 10 2004,
  • windows 10 20h2,
  • windows 10 21h1,
  • windows 8.1 -,
  • windows rt 8.1 -,
  • windows server 2008 -,
  • windows server 2012 -,
  • windows server 2016 -,
  • windows server 2016 2004,
  • windows server 2016 20h2,
  • windows server 2019 -

Additional Info

Technical Analysis