CVE-2021-33739

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Recent assessments:

gwillcox-r7 at June 17, 2021 5:19pm UTC reported:

Public PoC code has been supposively making the rounds courtesy of <https://github.com/mavillon1/CVE-2021-33739-POC&gt;. There is also a detailed writeup on this issue at <https://mp.weixin.qq.com/s/ZjJ4kXOCTSez2erVKYzKbg&gt; although it is in Chinese so you will need to translate it.

From the translation it seems this was originally discovered as being exploited in the wild by Shadow Lab in May 2021, and then they worked with Anheng Threat Intelligence Center to notify MSRC, who then patched the bug in the June 2021 patch release. The vulnerability is located in dwmcore.dll, which is the core DLL for DWM, aka the Desktop Windows Manager, on Windows machines. More specifically, its a UAF caused by an reference count tracking issue of the Tracker Binding Manager object. Its interesting also to note that they state this vulnerability only affects Windows 10 machines and does not affect Windows 8.1 and below; this is reflected in Microsoft’s advisory as well.

To trigger the vulnerability, one needs to “create a CinteractionTrackerBindingManagerMarshaler(0x59) resource and a CinteractionTrackerMarshaler(0x58) resource at the code level, and bind the same CinteractionTrackerMarshaler resource as resource1_id and resource2_id to the CinteractionTrackerBindingManagerMarshaler, and do not manually release the CinteractionTrackerBindingManagerMarshaler resource.”. I won’t discuss it further as the technical details are in the original writeup though but this should provide a brief overview for those interested.

The conclusion of this writeup notes that technically this vulnerability falls within the scope of Windows DirectComposition component, which has seen increased attacks over the last two years. It also notes that this may have ties to the release of the Win32k Dark: Attacking The Shadow Part of Graphic Subsystem presentation at the Cansecwest 2017 conference, where researchers discussed how to attack Windows DirectComposition in more detail.

Assessed Attacker Value: 3
Assessed Attacker Value: 3Assessed Attacker Value: 3