Microsoft Fixes Zero-Day Flaw in Win32 Driver

A previously known threat actor is using the flaw in a broad cyber-espionage campaign, security vendor warns.

Microsoft Tuesday released patches for more than 70 vulnerabilities, including a critical privilege escalation flaw in the Win32k driver that a known Chinese-speaking threat group has been exploiting in targeted attacks against defense contractors, IT companies, and diplomatic entities since at least August.
Microsofts batch of security updates for October also included fixes for three other publicly disclosed flaws as well as an Exchange Server vulnerability that the US National Security Agency (NSA) reported to the company. None of these flaws are known to be actively exploited currently.
CVE-2021-40449
, the flaw being exploited in the wild, is a so-called use-after-free vulnerability in the Win32k kernel driver that gives threat actors a way to escalate privileges on a compromised Windows machine. The flaw is not remotely exploitable.
Kaspersky
discovered the zero-day threat when investigating attacks on multiple Windows Servers between late August and early September 2021. The security vendors analysis of the malware used in the attacks showed that it was being used in a broad cyber-espionage campaign against organizations across several sectors.
Kaspersky is tracking the campaign as MysterySnail and has attributed it to a threat actor known as IronHusky and Chinese-speaking advanced persistent threat activity dating back to 2012.
Boris Larin, security researcher at Kaspersky, describes the flaw as easily exploitable and allowing attackers a way to gain full control of a vulnerable system after gaining an initial foothold. After successful exploitation attackers can do basically whatever they want — steal authentication credentials, attack other machines and services within a network and achieve persistence, Larin says.
Currently, the exploit code for the vulnerability is not publicly available and only the IronHusky group has been observed using it. However, the fact that the flaw is being actively exploited means organizations should apply Microsofts patch for it as quickly as possible Larin says. [The] vulnerability is in the Win32k kernel driver, which is an essential component of the OS. So, unfortunately, there are no workarounds for that flaw, he says.
Jake Williams, co-founder and CTO at BreachQuest, says organizations should not underestimate the threat that the Win32k flaw presents to their environment just because it isnt remotely exploitable. Threat actors regularly gain access to target machines using phishing attacks, and vulnerabilities such as CVE-2021-40449 allow them to bypass endpoint controls and evade detection more effectively.
Because the code for this has already been weaponized by one threat actor, we should expect to see it weaponized by others more quickly because there is already sample exploit code in the wild to work with, Williams says.
Publicly Disclosed Flaws
Three other vulnerabilities from Microsofts October patch update that have garnered some attention because they were publicly disclosed before patches became available today are
CVE-2021-40469
,
CVE-2021-41335
, and
CVE-2021-41338
. CVE-2021-40469 is a remote code execution flaw in Windows DNS server. Microsoft has described successful exploits against the flaw as likely having a high impact on data confidentiality, availability, and integrity. The flaw presents a threat if the targeted server is configured to be a DNS server; however, chances of exploitability are low, Microsoft said.
Williams from BreachQuest agrees the flaw is likely difficult to weaponize. But the fact that DNS servers typically run on domain controllers makes this an extremely serious issue, he says. A threat actor that gains remote code execution on a domain controller is likely to gain immediate domain administrator permissions. In the best-case scenario, they are a mere step away from taking domain administrator [privileges], he notes.
CVE-2021-41335, meanwhile, is a privilege escalation flaw in the Windows Kernel, while CVE-2021-41338 is a security feature bypass flaw in the Windows AppContainer Firewall. Though both flaws were publicly disclosed prior to todays patches and are therefore zero-day vulnerabilities, Microsoft has assessed the likelihood of the flaws being exploited as low.
NSA Alert
The flaw in Exchange Server that the NSA reported to Microsoft (
CVE-2021-26427
), meanwhile, is the latest in a growing list of critical vulnerabilities that researchers have discovered in Exchange Server this year. Attackers would already need to be on a targets network for them to be able to exploit the flaw. Microsoft says its exploitable if an attacker shares the same physical or local network as the target or is already within a secure or limited administrative domain.
Microsofts October patch update also included a patch for yet another vulnerability in the companys Print Spooler technology. The latest flaw (
CVE-2021-36970
) is a spoofing vulnerability in Print Spooler that Microsoft described as being something that attackers were more likely to exploit. Previous bugs in Print Spooler — including a set of flaws referred to as
PrintNightmare
—sparked considerable concern because of the potential damage attackers could do by exploiting them.
Some of Microsofts fixes for Print Spooler flaws have exacerbated concerns over the technology.
While Microsoft provided a fix in their September 2021 update, the patch resulted in a number of management problems, says Chris Morgan, senior cyber-threat intelligence analyst at Digital Shadows. Certain printers required users to repeatedly input their administrator credentials every time an application attempt to print or had a client connect to a print server, he says.
Other problems, he adds, included event logs recording error messages and denying users the ability to perform basic prints.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Fixes Zero-Day Flaw in Win32 Driver