Vulnerability Details : CVE-2021-40449

Exploit prediction scoring system (EPSS) score for CVE-2021-40449

Metasploit modules for CVE-2021-40449

• Win32k NtGdiResetDC Use After Free Local Privilege Elevation

  Disclosure Date : 2021-10-12

  exploit/windows/local/cve_2021_40449

  A use after free vulnerability exists in the `NtGdiResetDC()` function of Win32k which can be leveraged by an attacker to escalate privileges to those of `NT AUTHORITY\SYSTEM`. The flaw exists due to the fact that this function calls `hdcOpenDCW()`, which performs a user mode callback. During this callback, attackers can call the `NtGdiResetDC()` function again with the same handle as before, which will result in the PDC object that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle with their own object, before passing execution back to the original `NtGdiResetDC()` call, which will now use the attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\SYSTEM. This modul

  More information

CVSS scores for CVE-2021-40449

CWE ids for CVE-2021-40449

• CWE-269 Improper Privilege Management
  The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
  Assigned by: [email protected] (Primary)

References for CVE-2021-40449

Products affected by CVE-2021-40449