ID

VAR-202107-1170


CVE

CVE-2021-33771


TITLE

plural  Microsoft Windows  Elevated authority vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2021-002057

DESCRIPTION

Windows Kernel Elevation of Privilege Vulnerability. This vulnerability is CVE-2021-31979 and CVE-2021-34514 Is a different vulnerability.You may be elevated. Microsoft Windows Kernel是美国微软(Microsoft)公司的Windows操作系统的内核. microsoft Windows Kernel 存在缓冲区错误漏洞。以下产品和版本受到影响:Windows 10 Version 1809 for ARM64-based Systems,Windows Server 2019,Windows Server 2019 (Server Core installation),Windows 10 Version 1909 for 32-bit Systems,Windows 10 Version 1909 for x64-based Systems,Windows 10 Version 1909 for ARM64-based Systems,Windows 10 Version 21H1 for x64-based Systems,Windows 10 Version 21H1 for ARM64-based Systems,Windows 10 Version 21H1 for 32-bit Systems,Windows 10 Version 2004 for 32-bit Systems,Windows 10 Version 2004 for ARM64-based Systems,Windows 10 Version 2004 for x64-based Systems,Windows Server, version 2004 (Server Core installation),Windows 10 Version 20H2 for x64-based Systems,Windows 10 Version 20H2 for 32-bit Systems,Windows 10 Version 20H2 for ARM64-based Systems,Windows Server, version 20H2 (Server Core Installation),Windows 10 for 32-bit Systems,Windows 10 for x64-based Systems,Windows 10 Version 1607 for 32-bit Systems,Windows 10 Version 1607 for x64-based Systems,Windows Server 2016,Windows Server 2016 (Server Core installation),Windows 8.1 for 32-bit systems,Windows 10 Version 1809 for 32-bit Systems,Windows 10 Version 1809 for x64-based Systems,Windows 8.1 for x64-based systems,Windows RT 8.1,Windows Server 2012 R2,Windows Server 2012 R2 (Server Core installation). Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.79

sources: NVD: CVE-2021-33771 // JVNDB: JVNDB-2021-002057 // CNNVD: CNNVD-202107-806 // CNNVD: CNNVD-202104-975 // VULMON: CVE-2021-33771

AFFECTED PRODUCTS

vendor:microsoftmodel:windows 10 1809scope:ltversion:10.0.17763.2061

Trust: 1.0

vendor:microsoftmodel:windows rt 8.1scope:eqversion: -

Trust: 1.0

vendor:microsoftmodel:windows 8.1scope:eqversion: -

Trust: 1.0

vendor:microsoftmodel:windows 10 1909scope:ltversion:10.0.18363.1679

Trust: 1.0

vendor:microsoftmodel:windows 10 21h1scope:ltversion:10.0.19043.1110

Trust: 1.0

vendor:microsoftmodel:windows 10 1507scope:ltversion:10.0.10240.19003

Trust: 1.0

vendor:microsoftmodel:windows server 2019scope:ltversion:10.0.17763.2061

Trust: 1.0

vendor:microsoftmodel:windows 10 20h2scope:ltversion:10.0.19042.1110

Trust: 1.0

vendor:microsoftmodel:windows server 2012scope:eqversion: -

Trust: 1.0

vendor:microsoftmodel:windows server 2008scope:eqversion: -

Trust: 1.0

vendor:microsoftmodel:windows server 2016scope:ltversion:10.0.14393.4530

Trust: 1.0

vendor:microsoftmodel:windows server 2004scope:ltversion:10.0.19041.1110

Trust: 1.0

vendor:microsoftmodel:windows 10 2004scope:ltversion:10.0.19041.1110

Trust: 1.0

vendor:microsoftmodel:windows 10 1607scope:ltversion:10.0.14393.4530

Trust: 1.0

vendor:microsoftmodel:windows server 20h2scope:ltversion:10.0.19042.1110

Trust: 1.0

vendor:マイクロソフトmodel:microsoft windows serverscope:eqversion:2012 r2 (server core installation)

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows serverscope:eqversion:2019 (server core installation)

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows server 2019scope:eqversion:(server core installation)

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows 8.1scope: - version: -

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows server 2012scope: - version: -

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows serverscope:eqversion:20h2 (server core installation)

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows server 2016scope: - version: -

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows serverscope:eqversion:2004 (server core installation)

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows rt 8.1scope: - version: -

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows serverscope:eqversion:2016

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows server 2019scope:eqversion: -

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows serverscope:eqversion:2012 r2

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows 10scope: - version: -

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows serverscope:eqversion:2016 (server core installation)

Trust: 0.8

vendor:マイクロソフトmodel:microsoft windows serverscope:eqversion:2019

Trust: 0.8

sources: JVNDB: JVNDB-2021-002057 // NVD: CVE-2021-33771

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2021-33771
value: HIGH

Trust: 1.8

secure@microsoft.com: CVE-2021-33771
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202107-806
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

VULMON: CVE-2021-33771
value: HIGH

Trust: 0.1

NVD:
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

NVD: CVE-2021-33771
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.9

NVD:
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2021-33771
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2021-33771 // JVNDB: JVNDB-2021-002057 // CNNVD: CNNVD-202107-806 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-33771 // NVD: CVE-2021-33771

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:Improper authority management (CWE-269) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-002057 // NVD: CVE-2021-33771

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202107-806

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202107-806

CONFIGURATIONS

sources: NVD: CVE-2021-33771

PATCH

title:Windows Kernel Elevation of Privilege Vulnerability Security Update Guideurl:https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2021-33771

Trust: 0.8

title:Microsoft Windows Kernel Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=156499

Trust: 0.6

title:https://github.com/RENANZG/My-Forensicsurl:https://github.com/renanzg/my-forensics

Trust: 0.1

title:Known Exploited Vulnerabilities Detectorurl:https://github.com/ostorlab/kev

Trust: 0.1

title:Threatposturl:https://threatpost.com/catalangate-spyware/179336/

Trust: 0.1

title:Threatposturl:https://threatpost.com/windows-zero-days-israeli-spyware-dissidents/167865/

Trust: 0.1

title:The Registerurl:https://www.theregister.co.uk/2021/07/16/microsoft_candiru_malware/

Trust: 0.1

title: - url:https://www.welivesecurity.com/2021/07/14/microsoft-patch-tuesday-july/

Trust: 0.1

title:Threatposturl:https://threatpost.com/microsoft-crushes-116-bugs/167764/

Trust: 0.1

sources: VULMON: CVE-2021-33771 // JVNDB: JVNDB-2021-002057 // CNNVD: CNNVD-202107-806

EXTERNAL IDS

db:NVDid:CVE-2021-33771

Trust: 2.5

db:JVNDBid:JVNDB-2021-002057

Trust: 0.8

db:CS-HELPid:SB2021071322

Trust: 0.6

db:CNNVDid:CNNVD-202107-806

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:VULMONid:CVE-2021-33771

Trust: 0.1

sources: VULMON: CVE-2021-33771 // JVNDB: JVNDB-2021-002057 // CNNVD: CNNVD-202107-806 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-33771

REFERENCES

url:https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/cve-2021-33771

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-33771

Trust: 0.8

url:https://www.ipa.go.jp/security/ciadr/vul/20210714-ms.html

Trust: 0.8

url:https://www.jpcert.or.jp/at/2021/at210031.html

Trust: 0.8

url:https://vigilance.fr/vulnerability/windows-vulnerabilities-of-july-2021-35887

Trust: 0.6

url:https://msrc.microsoft.com/update-guide/vulnerability/cve-2021-33771

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021071322

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/119.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/renanzg/my-forensics

Trust: 0.1

url:https://threatpost.com/windows-zero-days-israeli-spyware-dissidents/167865/

Trust: 0.1

sources: VULMON: CVE-2021-33771 // JVNDB: JVNDB-2021-002057 // CNNVD: CNNVD-202107-806 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-33771

CREDITS

Microsoft Threat Intelligence Center (MSTIC)<br> Microsoft Security Response Center (MSRC)

Trust: 0.6

sources: CNNVD: CNNVD-202107-806

SOURCES

db:VULMONid:CVE-2021-33771
db:JVNDBid:JVNDB-2021-002057
db:CNNVDid:CNNVD-202107-806
db:CNNVDid:CNNVD-202104-975
db:NVDid:CVE-2021-33771

LAST UPDATE DATE

2024-07-28T22:50:38.812000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2021-33771date:2023-12-28T00:00:00
db:JVNDBid:JVNDB-2021-002057date:2021-07-30T04:31:00
db:CNNVDid:CNNVD-202107-806date:2022-05-06T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:NVDid:CVE-2021-33771date:2024-07-26T19:25:47.657

SOURCES RELEASE DATE

db:VULMONid:CVE-2021-33771date:2021-07-14T00:00:00
db:JVNDBid:JVNDB-2021-002057date:2021-07-30T00:00:00
db:CNNVDid:CNNVD-202107-806date:2021-07-13T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:NVDid:CVE-2021-33771date:2021-07-14T18:15:10.483