module

Win32k NtGdiResetDC Use After Free Local Privilege Elevation

Try Surface Command
Back to search
Disclosed
2021-10-12
Created
2021-11-10

Description

A use after free vulnerability exists in the `NtGdiResetDC()` function of Win32k which can be leveraged by
an attacker to escalate privileges to those of `NT AUTHORITY\SYSTEM`. The flaw exists due to the fact
that this function calls `hdcOpenDCW()`, which performs a user mode callback. During this callback, attackers
can call the `NtGdiResetDC()` function again with the same handle as before, which will result in the PDC object
that is referenced by this handle being freed. The attacker can then replace the memory referenced by the handle
with their own object, before passing execution back to the original `NtGdiResetDC()` call, which will now use the
attacker's object without appropriate validation. This can then allow the attacker to manipulate the state of the
kernel and, together with additional exploitation techniques, gain code execution as NT AUTHORITY\SYSTEM.

This module has been tested to work on Windows 10 x64 RS1 (build 14393) and RS5 (build 17763), however previous versions
of Windows 10 will likely also work.

Authors

IronHusky
Costin Raiu
Boris Larin
Red Raindrop Team of Qi'anxin Threat Intelligence Center
KaLendsi
ly4k
Grant Willcox

Platform

Windows

Architectures

x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/local/cve_2021_40449
    msf exploit(cve_2021_40449) > show targets
        ...targets...
    msf exploit(cve_2021_40449) > set TARGET < target-id >
    msf exploit(cve_2021_40449) > show options
        ...show and set options...
    msf exploit(cve_2021_40449) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today