Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is Guest VM to Hyper-V host server - virtualization security boundary.
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is memory from the file cache. This could include unintentional read access to memory contents in kernel space from a user mode process, and on a Hyper-V server this could result in Guest VM to Hyper-V host server memory content disclosure.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.
Security updates
10.0.17763.2061 — https://support.microsoft.com/help/5004244
10.0.18363.1679 — https://support.microsoft.com/help/5004245
10.0.19043.1110 — https://support.microsoft.com/help/5004237
10.0.10240.19204 — https://support.microsoft.com/help/5010358
10.0.14393.4946 — https://support.microsoft.com/help/5010359
6.1.7601.25860 — https://support.microsoft.com/help/5010404
6.1.7601.25860 — https://support.microsoft.com/help/5010422
6.3.9600.20269 — https://support.microsoft.com/help/5010419
6.3.9600.20269 — https://support.microsoft.com/help/5010395
6.0.6003.21374 — https://support.microsoft.com/help/5010384
6.0.6003.21372 — https://support.microsoft.com/help/5010403
6.2.9200.23605 — https://support.microsoft.com/help/5010392
6.2.9200.23605 — https://support.microsoft.com/help/5010412
Vulnerabilities 1
-
Medium 6.3
Windows Kernel Memory Information Disclosure Vulnerability
Windows Kernel Memory Information Disclosure Vulnerability
Revision history
-
#2
To comprehensively address CVE-2021-34500, Microsoft has released February 2022 security updates for the following supported editions of Microsoft Windows: Windows 10, Windows 10 Version 1607, Windows 8.1, Windows Server 2012 R2, Windows Server 2012, Windows 7, Windows Server 2008 R2, and Windows Server 2008. Microsoft strongly recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.
-
#1
Information published.
References
-
CVE-2021-34500 Windows Kernel Memory Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34500
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss