CVE-2021-31956
Published: 08 June 2021
Summary
CVE-2021-31956 is a high-severity Wrap or Wraparound (CWE-191) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-31956 is an elevation of privilege vulnerability in the Windows NTFS component, assigned CWE-191 and carrying a CVSS 3.1 score of 7.8. It affects Microsoft Windows systems that use the NTFS file system.
An attacker with local access and low privileges can exploit the flaw without user interaction to achieve full elevation of privilege, resulting in high impact to confidentiality, integrity, and availability on the target system.
Microsoft has published security guidance and patches for the issue through its advisory portal. The vulnerability is also listed in CISA's catalog of known exploited vulnerabilities, confirming observed in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-18829
Vulnerability details
Windows NTFS Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access-control decisions on NTFS objects that the CVE bypasses to achieve elevation of privilege.
Requires timely installation of the vendor patch that eliminates the NTFS integer-overflow flaw.
Limits the set of privileges available to a low-privileged local attacker, reducing the impact of a successful exploit.