New Windows and Linux Flaws Give Attackers Highest System Privileges
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-33909 | fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05. NVD description · AI analysis pending | 7.8 | 10% | PoC ×2 |
| — | |
| CVE-2021-33910 | basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a p basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash. NVD description · AI analysis pending | 5.5 | 9% | PoC ×2 |
| — | |
| CVE-2021-36934 | Local Privilege Escalation (SeriousSAM/HiveNightmare) in Microsoft Windows 10 CVE-2021-36934 is an elevation of privilege vulnerability in Windows caused by overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. A local attacker who already has the ability to execute low-privileged code on a victim system can leverage the misconfigured ACLs to gain arbitrary code execution with SYSTEM privileges, then install programs, view, change or delete data, or create new accounts with full user rights. Affected products per the CPE data are Windows 10 versions 1809, 1909, 2004, 20H2 and 21H1, with related coverage noting the bug impacts all Windows 10 versions released in the past 2.5 years and also references Windows 11. CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 2022-02-10, confirming in-the-wild exploitation, and EPSS assigns a 67.3% probability of exploitation within 30 days (99th percentile). Mitigation is two-step: installing the security update alone is not sufficient — administrators must also manually delete all shadow copies of system files, including the SAM database, per KB5005357. Do: Apply Microsoft's security update per vendor instructions, then follow KB5005357 to manually delete all shadow copies of system files (including the SAM database), because the update alone does not fully mitigate the vulnerability. Restrict or verify ACLs on the System32 config directory and shadow-copy access if shadow-copy deletion cannot be done immediately, and prioritize patching given the flaw's listing in CISA's Known Exploited Vulnerabilities Catalog. | 7.8 | 67% | KEV |
| masshundreds of millions of Windows 10 devices (every supported feature update from mid-2018 through mid-2021 is in scope) |
Full article507 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 21, 2021
Microsoft's Windows 10 and the upcoming Windows 11 versions have been found vulnerable to a new local privilege escalation vulnerability that permits users with low-level permissions access Windows system files, in turn, enabling them to unmask the operating system installation password and even decrypt private keys.
The vulnerability has been nicknamed "SeriousSAM."
"Starting with Windows 10 build 1809, non-administrative users are granted access to SAM, SYSTEM, and SECURITY registry hive files," CERT Coordination Center (CERT/CC) said in a vulnerability note published Monday. "This can allow for local privilege escalation (LPE)."
The operating system configuration files in question are as follows -
- c:\Windows\System32\config\sam
- c:\Windows\System32\config\system
- c:\Windows\System32\config\security
Microsoft, which is tracking the vulnerability under the identifier CVE-2021-36934, acknowledged the issue, but has yet to roll out a patch, or provide a timeline for when the fix will be made available.
"An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database," the Windows makers noted. "An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
Successful exploitation of the flaw, however, necessitates that the attacker already has a foothold and is in possession of the ability to execute code on the victim system. In the interim, the CERT/CC is recommending that users restrict access to sam, system, and security files and delete VSS shadow copies of the system drive.
The latest disclosure also marks the third publicly disclosed unpatched bug in Windows since the release of Patch Tuesday updates on July 13. Besides CVE-2021-36934, two more weaknesses affecting the Print Spooler component have also been discovered, prompting Microsoft to urge all users to stop and disable the service to protect systems against exploitation.
Linux Distros Suffer from "Sequoia" Privilege Escalation Flaw
It's not just Windows. Remediations have been released for a security shortcoming affecting all Linux kernel versions from 2014 that can be exploited by malicious users and malware already deployed on a system to gain root-level privileges.
Dubbed "Sequoia" by researchers from cybersecurity firm Qualys, the issue has been assigned the identifier CVE-2021-33909 and affects default installations of Ubuntu 20.04, Ubuntu 20.10, Ubuntu 21.04, Debian 11, and Fedora 34 Workstation. Red Hat Enterprise Linux versions 6, 7, and 8 are also affected by the vulnerability.
Specifically, the flaw concerns a size_t-to-int type conversion vulnerability in the Linux Kernel's "seq_file" file system interface, permitting an unprivileged local attacker to create, mount, and delete a deep directory structure whose total path length exceeds 1GB, resulting in privilege escalation on the vulnerable host.
Separately, Qualys also disclosed a stack exhaustion denial-of-service vulnerability in systemd (CVE-2021-33910) that could be exploited by unprivileged attackers to crash the software suite and trigger a kernel panic.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/07/new-windows-and-linux-flaws-give.html