Skip to content
OpenAdvisories
High MSRC-CVE-2021-38624 1 CVE

Windows Key Storage Provider Security Feature Bypass Vulnerability

Published Sep 14, 2021 · Updated Oct 12, 2021 · Revision 3

Vendor: Microsoft

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
A successful attacker could bypass the Windows Key Storage Provider which issues key certificates for trust in attestation scenarios.

Security updates
10.0.17763.2237 — https://support.microsoft.com/help/5006672
10.0.18363.1854 — https://support.microsoft.com/help/5006667
10.0.19043.1288 — https://support.microsoft.com/help/5006670
10.0.20348.288 — https://support.microsoft.com/help/5006699
10.0.22000.258 — https://support.microsoft.com/help/5006674

Vulnerabilities 1

Revision history

  1. #3

    The following revisions have been made: 1) To comprehensively address CVE-2021-38624, Microsoft has released the October 2021 Security Updates for all affected editions of Windows 10 Version 1809 and newer because these versions are also affected by CVE-2021-38624. 2) In the Security Updates table, Windows 11 for x64-based systems and Windows 11 for ARM64-based systems have been added as Windows 11 is also affected by this vulnerability. Microsoft strongly recommends that customers install the October updates to be fully protected from this vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  2. #2

    For all CVEs affecting Windows that were released on September 14, 2021: 1) In the Security Updates table, the Build Numbers for KB KB5005565 have been corrected for all affected editions of the following versions of Windows 10: Windows 10, version 2004, all editions; Windows Server, version 2004 (Server Core installation); Windows 10, version 20H2; Windows Server, version 20H2 (Server Core Installation); Windows 10, version 21H1. 2) For CVEs where Windows Server 2022 is affected the links have been updated to point to information related to [5005575](https://support.microsoft.com/en-us/help/5005575). Customers whose Windows devices are configured to receive automatic updates do not need to take any further action.

  3. #1

    Information published.

References