CVE-2021-31955
Microsoft Windows Kernel Information Disclosure Vulnerability
Description
CVE-2021-31955 is a MEDIUM information disclosure vulnerability in the Microsoft Windows Kernel with a CVSS 3.1 score of 5.5. The vulnerability allows a local authenticated attacker to read the contents of kernel memory from a user-mode process, potentially disclosing sensitive system information including kernel addresses useful for bypassing ASLR (Address Space Layout Randomization). Affected products include Microsoft Windows 10 (versions 1809, 1909, 2004, 20H2, and 21H1), Windows Server 2019, Windows Server 2004, and Windows Server 20H2. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.04647 (89.15th percentile), this vulnerability demonstrates significant real-world exploitation activity, often used as part of exploitation chains alongside privilege escalation vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.1999 |
| microsoft | windows 10 1909 | < 10.0.18363.1621 |
| microsoft | windows 10 2004 | < 10.0.19041.1052 |
| microsoft | windows 10 20h2 | < 10.0.19042.1052 |
| microsoft | windows 10 21h1 | < 10.0.19043.1052 |
| microsoft | windows server 2004 | < 10.0.19041.1052 |
| microsoft | windows server 2019 | < 10.0.17763.1999 |
| microsoft | windows server 20h2 | < 10.0.19042.1052 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31955(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31955(US Government Resource)
Weakness Type
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
CVE-2021-31955 is classified under CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere. This weakness occurs when a product reveals sensitive system-level information to actors who do not have the same level of access. In this case, the Windows Kernel discloses internal kernel memory contents to user-mode processes, exposing information that should only be accessible in kernel mode.
In the context of the Windows Kernel, this weakness is particularly dangerous because kernel address disclosure defeats ASLR, a critical security mitigation. Attackers use the leaked kernel addresses to precisely locate kernel data structures and code, making subsequent privilege escalation exploits far more reliable. This vulnerability was observed being exploited in conjunction with CVE-2021-31956 (a Windows NTFS elevation of privilege vulnerability) in targeted attacks attributed to the PuzzleMaker threat actor.
Learn more: CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere
Impact Analysis
CVE-2021-31955 carries a CVSS 3.1 score of 5.5 (MEDIUM) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation allows an attacker to read kernel memory contents from user mode, including kernel addresses, internal data structures, and potentially sensitive data processed by the kernel. This information is critical for crafting reliable kernel exploits.
Integrity (NONE): This vulnerability does not directly allow modification of kernel data or system state.
Availability (NONE): Exploitation of this information disclosure vulnerability does not directly impact system availability.
Scope Unchanged: The information disclosure is contained within the Windows kernel environment, though the leaked information enables attacks that extend beyond the kernel.
While the CVSS score of 5.5 reflects only the information disclosure impact, the real-world severity is significantly higher because this vulnerability is used as a building block in exploitation chains that achieve full system compromise.
Exploit Maturity
CVE-2021-31955 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability was discovered being actively exploited in the wild as a zero-day before the June 2021 patch. It was used by the PuzzleMaker threat actor in targeted attacks, combined with a Chrome zero-day (CVE-2021-21224) for initial access and CVE-2021-31956 (Windows NTFS EoP) for privilege escalation to achieve complete system compromise.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed. However, the vulnerability's role in APT exploitation chains makes it a high-priority target.
Attack surface: Exploitation requires local access and low-level privileges (standard user). The vulnerability affects the Windows kernel's handling of the SuperFetch (SysMain) service, which is enabled by default on affected Windows versions.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17.
Remediation
- Apply the June 2021 Microsoft security update immediately. Apply updates per vendor instructions. Consult the Microsoft Security Advisory at MSRC for specific patch guidance.
- Prioritize patching CVE-2021-31956 alongside this vulnerability. These two vulnerabilities were exploited together in the wild. Patch both simultaneously to close the complete attack chain.
- Verify all affected Windows systems are updated. Identify all instances of Windows 10 (1809, 1909, 2004, 20H2, 21H1), Windows Server 2019, Windows Server 2004, and Windows Server 20H2 in your environment. Use vulnerability scanning tools for comprehensive coverage.
- Monitor for exploitation chain indicators. Watch for suspicious patterns including Chrome exploitation followed by local privilege escalation, unusual kernel information access patterns, and indicators associated with the PuzzleMaker threat actor.
- Implement defense-in-depth measures. Ensure all security mitigations are enabled (ASLR, DEP, CFG), deploy endpoint detection and response solutions, and restrict unnecessary local execution privileges.
- Review browser security configurations. Since this vulnerability was part of a chain starting with browser exploitation, ensure browsers are updated and consider implementing browser isolation for high-risk users.
Technical Details
CVE-2021-31955 is a MEDIUM-severity information disclosure vulnerability in the Windows Kernel. The attack vector is local, meaning the attacker must have the ability to execute code on the target system. The attack complexity is low. Low-level privileges (standard user) are required. No user interaction is needed.
Technical mechanism: The vulnerability exists in the Windows Kernel's interaction with the SuperFetch (SysMain) service. The kernel improperly exposes Extended Translation Lookaside Buffer (ETLB) information, including kernel memory addresses, to user-mode processes through the NtQuerySystemInformation system call. By querying specific system information classes, a local attacker can obtain kernel-mode virtual addresses that reveal the location of kernel data structures in memory. This information defeats ASLR and enables precise targeting of kernel objects for subsequent privilege escalation exploits.
CVSS 3.1 vector analysis: The vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a Local Attack Vector, Low Complexity, Low Privileges Required, No User Interaction, HIGH Confidentiality impact, and no Integrity or Availability impact. The score of 5.5 reflects the information disclosure nature of the vulnerability.
Affected products: Microsoft Windows 10 (versions 1809, 1909, 2004, 20H2, 21H1), Windows Server 2019, Windows Server 2004, Windows Server 20H2.
Frequently Asked Questions
Is CVE-2021-31955 being actively exploited?
Yes, CVE-2021-31955 was exploited as a zero-day before the June 2021 patch by the PuzzleMaker threat actor. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and has an EPSS score of 0.04647 (89.15th percentile). It was used in combination with a Chrome zero-day and CVE-2021-31956 for complete system compromise.
What products are affected by CVE-2021-31955?
Affected products include Microsoft Windows 10 (versions 1809, 1909, 2004, 20H2, and 21H1), Windows Server 2019, Windows Server 2004, and Windows Server 20H2. The vulnerability affects the kernel's SuperFetch (SysMain) service interaction.
How do I fix CVE-2021-31955?
Apply the June 2021 Microsoft security update from MSRC. Patch this vulnerability alongside CVE-2021-31956, as both were exploited together in the wild. Verify all affected Windows versions are updated using vulnerability scanning tools.
How severe is CVE-2021-31955?
CVE-2021-31955 is rated MEDIUM with a CVSS 3.1 score of 5.5. While the CVSS score reflects only the information disclosure impact, the real-world severity is higher because this vulnerability was used as part of a zero-day exploitation chain for full system compromise. Its EPSS score of 0.04647 places it in the 89.15th percentile for exploitation likelihood.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.