CVE-2021-31979

CVE-2021-31979 is an elevation-of-privilege vulnerability in the Microsoft Windows kernel caused by improper handling of objects in memory (CWE-119), rated 7.8 (high) with local attack vector, low privileges required, and no user interaction. An attacker who already has limited privileges on a machine can trigger the flaw with specially crafted code, gaining code execution in kernel/SYSTEM context and full control of the host. It is most dangerous when chained with a remote code execution bug to move from a network foothold to SYSTEM — the pattern reported in the July 2021 spyware campaign linked to the Israeli surveillance vendor Candiru. Any organization running the affected Windows 10 versions (1507 through 21H1), Windows 7, Windows 8.1/RT 8.1, or Windows Server 2004/2008 is exposed. The flaw was fixed in Microsoft's July 2021 Patch Tuesday release, was exploited in the wild, and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with the required action of applying vendor updates.

What to do: Apply Microsoft's July 2021 (or later cumulative) Windows security updates to every affected Windows 10, 7, 8.1, RT 8.1, and Server 2004/2008 system — this is the CISA-required action, and no public PoC or workaround is known, so patching is the primary mitigation. Prioritize user-facing workstations and any Windows host where unprivileged users can run code, since this local flaw is commonly chained with a remote code execution bug. Verify patch levels against the July 2021 release and review hosts that missed it for signs of the Candiru-linked spyware activity reported at the time.