Jul 2021: Windows Elevation of Privilege Vulnerability
CVE-2021-36934 Published on July 22, 2021
Windows Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>An attacker must have the ability to execute code on a victim system to exploit this vulnerability.</p>
<p>After installing this security update, you <em>must</em> manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. <strong>Simply installing this security update will not fully mitigate this vulnerability.</strong> See <a href="https://support.microsoft.com/topic/1ceaa637-aaa3-4b58-a48b-baf72a2fa9e7">KB5005357- Delete Volume Shadow Copies</a>.</p>
Known Exploited Vulnerability
This Microsoft Windows SAM Local Privilege Escalation Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.
The following remediation steps are recommended / required by February 24, 2022: Apply updates per vendor instructions.
Products Associated with CVE-2021-36934
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-36934 are published in these products:
Affected Versions
Microsoft Windows 10 Version 1809:- Version 10.0.0 and below 10.0.17763.2114 is affected.
- Version 10.0.0 and below 10.0.18363.1734 is affected.
- Version 10.0.0 and below 10.0.19043.1165 is affected.
- Version 10.0.0 and below 10.0.19041.1165 is affected.
- Version 10.0.0 and below 10.0.19042.1165 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.