CVE-2021-40449 actively exploited zero-day patched in October 2021 Patch Tuesday
Hello everyone,
Microsoft Patch Tuesday October 2021 comes with fixes for 81 vulnerabilities (including Microsoft Edge for chromium updates), of which 4 are zero-day vulnerabilities.
Of the 4 zero-days, one is actively exploited and the other 3 are publicly disclosed vulnerabilities. The details of which are given below:
Publicly disclosed but not actively exploited:
CVE-2021-40469 - Windows DNS Server Remote Code Execution Vulnerability
CVE-2021-41335 - Windows Kernel Elevation of Privilege Vulnerability
CVE-2021-41338 - Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability
Actively exploited:
CVE-2021-40449 - Win32k Elevation of Privilege Vulnerability
Vulnerability description of CVE-2021-40449
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the Win32k driver in Microsoft Windows kernel. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code with elevated privileges.
Patch details: CVE-2021-40449
| Patch ID | Bulletin ID | Description |
| 32203 | MS21-OCT2 | 2021-10 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5006715) (CVE-2021-40449) (CVE-2021-40469) (ESU) |
| 32202 | MS21-OCT2 | 2021-10 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5006715) (CVE-2021-40449) (CVE-2021-40469) (ESU) |
| 32201 | MS21-OCT2 | 2021-10 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5006728) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) (ESU) |
| 32199 | MS21-OCT2 | 2021-10 Security Only Quality Update for Windows 7 for x64-based Systems (KB5006728) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) (ESU) |
| 32200 | MS21-OCT2 | 2021-10 Security Only Quality Update for Windows 7 for x86-based Systems (KB5006728) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) (ESU) |
| 32164 | MS21-OCT2 | 2021-10 Security Only Quality Update for Windows Server 2012 for x64-based Systems (KB5006732) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32162 | MS21-OCT2 | 2021-10 Security Only Quality Update for Windows Server 2012 R2 for x64-based Systems (KB5006729) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32163 | MS21-OCT2 | 2021-10 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5006729) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32161 | MS21-OCT2 | 2021-10 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5006729) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32181 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 1909 for x64-based Systems (KB5006667) (CVE-2021-40449) (CVE-2021-41335) (CVE-2021-41338) |
| 32182 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 1909 for x86-based Systems (KB5006667) (CVE-2021-40449) (CVE-2021-41335) (CVE-2021-41338) |
| 32177 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB5006669) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32179 | MS21-OCT3 | 2021-10 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5006669) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32178 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 1607 for x86-based Systems (KB5006669) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32167 | MS21-OCT3 | 2021-10 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5006670) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32170 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 2004 for x64-based Systems (KB5006670) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32165 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 20H2 for x64-based Systems (KB5006670) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32171 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 21H1 for x64-based Systems (KB5006670) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32169 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 2004 for x86-based Systems (KB5006670) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32168 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 20H2 for x86-based Systems (KB5006670) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32172 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 21H1 for x86-based Systems (KB5006670) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32184 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 1809 for x64-based Systems (KB5006672) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32183 | MS21-OCT3 | 2021-10 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5006672) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32185 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 1809 for x86-based Systems (KB5006672) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32176 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 11 for x64-based Systems (KB5006674) |
| 32175 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 1507 for x64-based Systems (KB5006675) (CVE-2021-40449) (CVE-2021-41335) (CVE-2021-41338) |
| 32174 | MS21-OCT3 | 2021-10 Cumulative Update for Windows 10 Version 1507 for x86-based Systems (KB5006675) (CVE-2021-40449) (CVE-2021-41335) (CVE-2021-41338) |
| 32180 | MS21-OCT3 | 2021-10 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5006699) (CVE-2021-40449) (CVE-2021-40469) |
| 32205 | MS21-OCT6 | 2021-10 Security Monthly Quality Rollup for Windows Server 2008 for x64-based Systems (KB5006736) (CVE-2021-40449) (CVE-2021-40469) (ESU) |
| 32204 | MS21-OCT6 | 2021-10 Security Monthly Quality Rollup for Windows Server 2008 for x86-based Systems (KB5006736) (CVE-2021-40449) (CVE-2021-40469) (ESU) |
| 32207 | MS21-OCT6 | 2021-10 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB5006743) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) (ESU) |
| 32208 | MS21-OCT6 | 2021-10 Security Monthly Quality Rollup for Windows 7 for x64-based Systems (KB5006743) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) (ESU) |
| 32206 | MS21-OCT6 | 2021-10 Security Monthly Quality Rollup for Windows 7 for x86-based Systems (KB5006743) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) (ESU) |
| 32198 | MS21-OCT6 | 2021-10 Security Monthly Quality Rollup for Windows Server 2012 for x64-based Systems (KB5006739) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32195 | MS21-OCT6 | 2021-10 Security Monthly Quality Rollup for Windows Server 2012 R2 for x64-based Systems (KB5006714) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32196 | MS21-OCT6 | 2021-10 Security Monthly Quality Rollup for Windows 8.1 for x64-based Systems (KB5006714) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
| 32197 | MS21-OCT6 | 2021-10 Security Monthly Quality Rollup for Windows 8.1 for x86-based Systems (KB5006714) (CVE-2021-40449) (CVE-2021-40469) (CVE-2021-41335) (CVE-2021-41338) |
Cheers,
The ManageEngine team