Skip to content
OpenAdvisories
High MSRC-CVE-2021-34500 1 CVE

Windows Kernel Memory Information Disclosure Vulnerability

Published Jul 13, 2021 · Updated Feb 8, 2022 · Revision 2

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is Guest VM to Hyper-V host server - virtualization security boundary.

What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is memory from the file cache. This could include unintentional read access to memory contents in kernel space from a user mode process, and on a Hyper-V server this could result in Guest VM to Hyper-V host server memory content disclosure.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.

Security updates
10.0.17763.2061 — https://support.microsoft.com/help/5004244
10.0.18363.1679 — https://support.microsoft.com/help/5004245
10.0.19043.1110 — https://support.microsoft.com/help/5004237
10.0.10240.19204 — https://support.microsoft.com/help/5010358
10.0.14393.4946 — https://support.microsoft.com/help/5010359
6.1.7601.25860 — https://support.microsoft.com/help/5010404
6.1.7601.25860 — https://support.microsoft.com/help/5010422
6.3.9600.20269 — https://support.microsoft.com/help/5010419
6.3.9600.20269 — https://support.microsoft.com/help/5010395
6.0.6003.21374 — https://support.microsoft.com/help/5010384
6.0.6003.21372 — https://support.microsoft.com/help/5010403
6.2.9200.23605 — https://support.microsoft.com/help/5010392
6.2.9200.23605 — https://support.microsoft.com/help/5010412

Vulnerabilities 1

Revision history

  1. #2

    To comprehensively address CVE-2021-34500, Microsoft has released February 2022 security updates for the following supported editions of Microsoft Windows: Windows 10, Windows 10 Version 1607, Windows 8.1, Windows Server 2012 R2, Windows Server 2012, Windows 7, Windows Server 2008 R2, and Windows Server 2008. Microsoft strongly recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  2. #1

    Information published.

References