CVE-2021-36934
Microsoft Windows SAM Local Privilege Escalation Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
12Exploited in Wild
YesDecision
Descriptions
<p>An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>An attacker must have the ability to execute code on a victim system to exploit this vulnerability.</p>
<p>After installing this security update, you <em>must</em> manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. <strong>Simply installing this security update will not fully mitigate this vulnerability.</strong> See <a href="https://support.microsoft.com/topic/1ceaa637-aaa3-4b58-a48b-baf72a2fa9e7">KB5005357- Delete Volume Shadow Copies</a>.</p>
Una Vulnerabilidad de Elevación de Privilegios en Windows
If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-07-19 CVE Reserved
- 2021-07-22 CVE Published
- 2021-07-22 First Exploit
- 2022-02-10 Exploited in Wild
- 2022-02-24 KEV Due Date
- 2024-08-04 CVE Updated
- 2024-11-07 EPSS Updated
CWE
CAPEC
References (17)
| URL | Date | SRC |
|---|---|---|
| https://github.com/Preventions/CVE-2021-36934 | 2021-07-24 | |
| https://github.com/JoranSlingerland/CVE-2021-36934 | 2021-08-11 | |
| https://github.com/n3tsurge/CVE-2021-36934 | 2021-07-22 | |
| https://github.com/exploitblizzard/CVE-2021-36934 | 2021-07-27 | |
| https://github.com/tda90/CVE-2021-36934 | 2021-07-29 | |
| https://github.com/websecnl/CVE-2021-36934 | 2021-09-04 | |
| https://github.com/bytesizedalex/CVE-2021-36934 | 2021-07-23 | |
| https://github.com/irissentinel/CVE-2021-36934 | 2021-07-30 | |
| https://github.com/0x0D1n/CVE-2021-36934 | 2021-07-26 | |
| https://github.com/VertigoRay/CVE-2021-36934 | 2021-07-24 | |
| https://github.com/OlivierLaflamme/CVE-2021-36934-export-shadow-volume-POC | 2021-08-10 | |
| https://github.com/jmaddington/Serious-Sam---CVE-2021-36934-Mitigation-for-Datto-RMM | 2021-07-25 |
| URL | Date | SRC |
|---|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934 | 2024-07-24 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Windows 10 1809 Search vendor "Microsoft" for product "Windows 10 1809" | < 10.0.17763.2114 Search vendor "Microsoft" for product "Windows 10 1809" and version " < 10.0.17763.2114" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 10 1909 Search vendor "Microsoft" for product "Windows 10 1909" | < 10.0.18363.1734 Search vendor "Microsoft" for product "Windows 10 1909" and version " < 10.0.18363.1734" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 10 2004 Search vendor "Microsoft" for product "Windows 10 2004" | < 10.0.19041.1165 Search vendor "Microsoft" for product "Windows 10 2004" and version " < 10.0.19041.1165" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 10 20h2 Search vendor "Microsoft" for product "Windows 10 20h2" | < 10.0.19042.1165 Search vendor "Microsoft" for product "Windows 10 20h2" and version " < 10.0.19042.1165" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Windows 10 21h1 Search vendor "Microsoft" for product "Windows 10 21h1" | < 10.0.19043.1165 Search vendor "Microsoft" for product "Windows 10 21h1" and version " < 10.0.19043.1165" | - |
Affected
| ||||||