Security restrictions bypass in Microsoft Surface Pro 3



Published: 2021-10-19
Risk Low
Patch available NO
Number of vulnerabilities 1
CVE-ID CVE-2021-42299
CWE-ID CWE-254
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe
Microsoft Surface
Hardware solutions / Firmware

Vendor Microsoft

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Security features bypass

EUVDB-ID: #VU57423

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2021-42299

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists in the Platform Configuration Registers (PCRs) implementation. An attacker with physical access to device can can bypass implemented security restrictions.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Microsoft Surface: Pro 3

CPE2.3 External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42299

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###