CVE-2021-34484
Microsoft Windows User Profile Service Privilege Escalation Vulnerability
Description
CVE-2021-34484 is a privilege escalation vulnerability in the Microsoft Windows User Profile Service that allows a locally authenticated attacker to elevate privileges to SYSTEM level. The vulnerability was initially patched by Microsoft but the fix was found to be incomplete, allowing bypass of the original patch. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 4.5% (93rd percentile), this vulnerability presents a significant post-compromise escalation risk.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19022 |
| microsoft | windows 10 1607 | < 10.0.14393.4583 |
| microsoft | windows 10 1809 | < 10.0.17763.2114 |
| microsoft | windows 10 1909 | < 10.0.18363.1734 |
| microsoft | windows 10 2004 | < 10.0.19041.1165 |
| microsoft | windows 10 20h2 | < 10.0.19042.1165 |
| microsoft | windows 10 21h1 | < 10.0.19043.1165 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2004 | < 10.0.19041.1165 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4583 |
| microsoft | windows server 2019 | < 10.0.17763.2114 |
| microsoft | windows server 20h2 | < 10.0.19042.1165 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34484(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34484(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34484(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
Improper privilege management occurs when an application does not properly assign, modify, track, or check privileges for an actor, allowing the actor to gain unauthorized access to resources. In CVE-2021-34484, the Windows User Profile Service improperly handles directory junction operations, enabling authenticated users to escalate to SYSTEM privileges. For more details, see CWE-269.
Impact Analysis
Successful exploitation allows a standard authenticated user to escalate privileges to SYSTEM, the highest privilege level on Windows systems. SYSTEM-level access grants complete control over the operating system, including the ability to install software, access all files, modify security settings, and create new administrator accounts. This vulnerability is particularly valuable in attack chains where an attacker has gained initial access with limited privileges and needs to escalate for full system control. The fact that the initial patch was bypassed underscores the complexity of the underlying issue and the persistence of the risk.
Exploit Maturity
CVE-2021-34484 was added to CISA's KEV catalog on March 31, 2022. The EPSS score of 4.5% (93rd percentile) reflects active but more targeted exploitation compared to remotely exploitable vulnerabilities. The vulnerability gained additional attention when a security researcher demonstrated that Microsoft's original August 2021 patch could be bypassed, leading to the need for additional patches. Public exploit code is available, making this vulnerability accessible for post-compromise privilege escalation.
Remediation
- Apply all Windows security updates including the patches that address both the original vulnerability and the patch bypass, as required by CISA's KEV catalog.
- Monitor for and apply subsequent updates related to CVE-2021-34484 as Microsoft has released multiple fixes addressing bypass techniques.
- Implement endpoint detection and response (EDR) solutions that can detect privilege escalation attempts through User Profile Service exploitation.
- Apply the principle of least privilege, ensuring users operate with the minimum necessary permissions to reduce the impact of privilege escalation.
- Enable Windows security audit policies to log privilege escalation events and User Profile Service operations for forensic analysis.
Technical Details
The vulnerability exploits a race condition in the Windows User Profile Service (ProfSvc) during the handling of temporary user profile operations. When a user profile is being created or loaded, the service performs operations on directories with SYSTEM privileges. By creating a carefully timed directory junction (symbolic link) during this process, an attacker can redirect the service's file operations to arbitrary locations. This allows overwriting or creating files in system-protected directories with SYSTEM-level permissions. The original Microsoft patch attempted to block the junction-based attack but did not fully address all exploitation paths, allowing researchers to find bypass techniques that achieved the same privilege escalation through slightly modified attack vectors.
Frequently Asked Questions
What is CVE-2021-34484?
CVE-2021-34484 is a privilege escalation vulnerability in the Windows User Profile Service that allows authenticated local users to escalate to SYSTEM privileges by exploiting a race condition in how the service handles directory operations.
Why was this vulnerability patched multiple times?
Microsoft's initial patch in August 2021 did not fully address the vulnerability. Security researchers found that the fix could be bypassed using modified techniques that still exploited the same underlying issue. Microsoft released additional patches to address these bypasses.
Can this be exploited remotely?
No, this vulnerability requires local authenticated access to the system. An attacker must first gain access to a standard user account through other means before exploiting this vulnerability for privilege escalation.
What is the typical attack scenario?
An attacker first gains access to a system through phishing, credential theft, or another vulnerability. Once they have a standard user session, they exploit CVE-2021-34484 to escalate to SYSTEM privileges, giving them complete control of the system for data theft, lateral movement, or persistence.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.