CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
41.6%
Microsoft DWM Core Library Elevation of Privilege Vulnerability
Recent assessments:
gwillcox-r7 at June 17, 2021 5:19pm UTC reported:
Public PoC code has been supposively making the rounds courtesy of <https://github.com/mavillon1/CVE-2021-33739-POC>. There is also a detailed writeup on this issue at <https://mp.weixin.qq.com/s/ZjJ4kXOCTSez2erVKYzKbg> although it is in Chinese so you will need to translate it.
From the translation it seems this was originally discovered as being exploited in the wild by Shadow Lab in May 2021, and then they worked with Anheng Threat Intelligence Center to notify MSRC, who then patched the bug in the June 2021 patch release. The vulnerability is located in dwmcore.dll
, which is the core DLL for DWM, aka the Desktop Windows Manager, on Windows machines. More specifically, its a UAF caused by an reference count tracking issue of the Tracker Binding Manager object. Its interesting also to note that they state this vulnerability only affects Windows 10 machines and does not affect Windows 8.1 and below; this is reflected in Microsoftβs advisory as well.
To trigger the vulnerability, one needs to βcreate a CinteractionTrackerBindingManagerMarshaler(0x59) resource and a CinteractionTrackerMarshaler(0x58) resource at the code level, and bind the same CinteractionTrackerMarshaler resource as resource1_id and resource2_id to the CinteractionTrackerBindingManagerMarshaler, and do not manually release the CinteractionTrackerBindingManagerMarshaler resource.β. I wonβt discuss it further as the technical details are in the original writeup though but this should provide a brief overview for those interested.
The conclusion of this writeup notes that technically this vulnerability falls within the scope of Windows DirectComposition component, which has seen increased attacks over the last two years. It also notes that this may have ties to the release of the Win32k Dark: Attacking The Shadow Part of Graphic Subsystem
presentation at the Cansecwest 2017 conference, where researchers discussed how to attack Windows DirectComposition in more detail.
Assessed Attacker Value: 3
Assessed Attacker Value: 3Assessed Attacker Value: 3
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
41.6%