Improper Privilege Management in Microsoft Windows and Windows Server - CVE-2021-31955

Vulnerability details

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper privilege management. A local unprivileged user can read contents of Kernel memory from a user mode process.

Note, the vulnerability is being actively exploited in the wild.

Affected software

How to mitigate CVE-2021-31955

Links to Public Exploits and PoC-codes

• Exploit #6901 - CVE-2021-31955-POC () (October 18, 2021)
• Exploit #6608 - CVE-2021-31955-POC () (August 9, 2021)
• Exploit #6474 - CVE-2021-31955-POC () (June 27, 2021)

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31955

Related Security Bulletins

• OS Kernel information disclosure Microsoft Windows
• Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler