CVE-2021-31979
Microsoft Windows Kernel Privilege Escalation Vulnerability
Description
CVE-2021-31979 is a HIGH-severity privilege escalation vulnerability in the Microsoft Windows kernel with a CVSS 3.1 score of 7.8. The Windows kernel contains an improper restriction of operations within the bounds of a memory buffer that allows a local attacker with low privileges to escalate to kernel-level execution. This vulnerability affects a wide range of Windows versions including Windows 7, Windows 8.1, Windows 10 (multiple builds), Windows Server 2008 through 2019, and Windows Server 20H2. CVE-2021-31979 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. The EPSS score of 0.12465 (93.80th percentile) indicates significant exploitation probability, making immediate patching essential.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19003 |
| microsoft | windows 10 1607 | < 10.0.14393.4530 |
| microsoft | windows 10 1809 | < 10.0.17763.2061 |
| microsoft | windows 10 1909 | < 10.0.18363.1679 |
| microsoft | windows 10 2004 | < 10.0.19041.1110 |
| microsoft | windows 10 20h2 | < 10.0.19042.1110 |
| microsoft | windows 10 21h1 | < 10.0.19043.1110 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2004 | < 10.0.19041.1110 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4530 |
| microsoft | windows server 2019 | < 10.0.17763.2061 |
| microsoft | windows server 20h2 | < 10.0.19042.1110 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31979(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31979(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31979(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2021-31979 is classified under CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer. This weakness occurs when software performs operations on a memory buffer without properly restricting the size or boundaries of those operations. When read or write operations exceed the allocated buffer boundaries, adjacent memory regions can be corrupted, leading to crashes, data corruption, or arbitrary code execution.
In the context of the Windows kernel, this weakness is especially dangerous because kernel-level buffer violations can allow attackers to overwrite critical kernel data structures, bypass security mechanisms such as SMEP and KASLR, and achieve complete system compromise. Kernel memory corruption vulnerabilities are highly prized by exploit developers for building reliable local privilege escalation chains.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2021-31979 carries a CVSS 3.1 score of 7.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker full read access to kernel memory, enabling extraction of sensitive credentials, encryption keys, and security tokens stored in kernel space.
Integrity (HIGH): An attacker who achieves kernel-level code execution can modify any system data, install rootkits, tamper with security controls, and alter audit logs to cover their tracks.
Availability (HIGH): Exploitation can cause system instability, blue screen crashes, or complete denial of service. A kernel-level attacker can also terminate processes and disable services at will.
Scope Unchanged: The vulnerability's scope is Unchanged (U), meaning the impact is contained within the Windows kernel and its directly managed resources. However, given that the kernel controls the entire operating system, the practical impact is system-wide.
With an EPSS score of 0.12465 (93.80th percentile), this vulnerability has a high probability of being exploited in real-world attacks.
Exploit Maturity
CVE-2021-31979 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: The vulnerability has been actively exploited as confirmed by its inclusion in the KEV catalog. The EPSS score of 0.12465 (93.80th percentile) reflects substantial real-world exploitation activity.
Ransomware association: No direct ransomware association has been confirmed for CVE-2021-31979 per the KEV data. However, privilege escalation vulnerabilities in the Windows kernel are commonly used in attack chains that precede ransomware deployment.
Attack surface: As a local privilege escalation, this vulnerability requires an attacker to have initial code execution on the target system. It is commonly chained with remote code execution vulnerabilities or phishing attacks to achieve full system compromise.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. All organizations should treat this as an urgent priority.
Remediation
- Apply Microsoft security updates immediately. Install the July 2021 Patch Tuesday updates per Microsoft's advisory at portal.msrc.microsoft.com. Prioritize all affected Windows systems.
- Inventory affected systems. Identify all Windows 7, 8.1, 10, Server 2008, 2012, 2016, 2019, and 20H2 systems in your environment. Use asset management and vulnerability scanning tools to ensure complete coverage.
- Implement defense-in-depth measures. Restrict local access to sensitive systems, enforce least privilege principles, and use application control policies to limit execution of unauthorized code.
- Monitor for exploitation indicators. Review system event logs for suspicious kernel-mode activity, unexpected privilege escalations, and anomalous process behavior that may indicate exploitation attempts.
- Update endpoint detection tools. Ensure EDR and antivirus solutions have current signatures capable of detecting exploitation techniques associated with CVE-2021-31979.
- Prioritize end-of-life systems. Windows 7 and Server 2008 are no longer receiving regular updates. Plan migration to supported operating system versions as a long-term mitigation strategy.
Technical Details
CVE-2021-31979 is a HIGH-severity privilege escalation vulnerability in the Windows kernel that requires local access to exploit. The attack complexity is low, meaning no specialized conditions or timing windows are needed. The attacker requires low privileges (standard user account) to initiate the attack. No user interaction is required.
Technical mechanism: The vulnerability exists due to improper restriction of operations within the bounds of a memory buffer in the Windows kernel. An attacker with local access and low-level privileges can trigger a buffer boundary violation in kernel memory, corrupting adjacent data structures. By carefully controlling the overflow, an attacker can overwrite kernel objects to redirect execution flow and escalate from a standard user to SYSTEM-level privileges.
CVSS 3.1 vector analysis: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — The local attack vector combined with low complexity and low privilege requirements makes this an accessible exploit for attackers who have gained initial foothold on a system. The high impact across all three CIA triad components reflects the severity of kernel-level compromise.
Affected products: Windows 10 (1507 through 21H1), Windows 7, Windows 8.1, Windows RT 8.1, Windows Server 2004, 2008, 2012, 2016, 2019, and 20H2.
Frequently Asked Questions
Is CVE-2021-31979 being actively exploited?
Yes, CVE-2021-31979 is being actively exploited in the wild. It is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2021-11-17. The EPSS score of 0.12465 (93.80th percentile) confirms significant real-world exploitation activity.
Which products are affected by CVE-2021-31979?
CVE-2021-31979 affects a broad range of Microsoft Windows products including Windows 7, Windows 8.1, Windows 10 (builds 1507 through 21H1), Windows RT 8.1, and multiple Windows Server versions (2004, 2008, 2012, 2016, 2019, 20H2). Organizations should inventory all Windows systems and prioritize patching.
How do I fix CVE-2021-31979?
Apply the July 2021 security updates from Microsoft. Consult the official advisory for version-specific patches. For systems that cannot be immediately patched, restrict local access, enforce least privilege, and implement enhanced monitoring for suspicious kernel-level activity.
How severe is CVE-2021-31979?
CVE-2021-31979 is rated HIGH with a CVSS 3.1 score of 7.8. It enables local privilege escalation to kernel level, giving attackers complete control over the affected system. While local access is required, it is commonly chained with remote access exploits for full compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.