CVE-2021-1732: Microsoft Windows Local Privilege Escalation Vulnerability Alert

Vulnerability Detail

This local privilege escalation would allow a logged-on user to execute code of their choosing at higher privileges. Bugs of this nature are typically paired with another bug that allows code execution a the logged-on user level. For example, this could be paired with an Adobe Reader exploit. An attacker would entice a user to open a specially crafted PDF, which would result in code execution through the Reader bug then escalation through this bug. This is also a common tactic for malware.

The vulnerability is caused by the function win32kfull!xxxCreateWindowEx’s lax verification of the data returned by the application layer callback. Local users execute the exploit program to obtain system permissions.

As shown below, after the sample runs, the token of the current process will be modified to the system token to complete the privilege escalation operation.

Affected version