CVE-2021-31979

What it actually does

CVE-2021-31979 is a local Windows Kernel elevation-of-privilege vulnerability caused by memory corruption in kernel-mode code. An attacker who already has the ability to run code as a low-privileged local user can exploit the flaw to execute code with elevated, typically SYSTEM-level, privileges. Successful exploitation can allow full compromise of confidentiality, integrity, and availability on the affected Windows host, including disabling security tooling, accessing protected data, installing persistent services or drivers, and moving laterally using credentials or tokens available on the system.

Why it matters to the business

This vulnerability turns an initial low-privilege foothold on a Windows workstation or server into full host control. Because affected products include many widely deployed Windows desktop and server versions, unpatched systems can become high-value escalation points after phishing, credential theft, web-shell deployment, malware execution, or abuse of exposed services. The vulnerability is listed in CISA KEV and has been observed exploited in the wild, with a federal remediation due date of 2021-11-17, so continued exposure should be treated as a priority legacy patching and incident-review issue even though the CVSS score is 7.8 and EPSS is relatively low.

How an attack unfolds

An attacker first gains local code execution on a vulnerable Windows system, commonly through phishing, malicious documents, stolen remote-access credentials, exploitation of another vulnerability, or malware already running under a standard user context. The attacker then runs an exploit that triggers the Windows Kernel memory-corruption condition. By manipulating kernel memory, the exploit elevates the attacker's privileges from a normal user to an administrator or SYSTEM context. With those privileges, the attacker can dump credentials, tamper with endpoint defenses, create local administrator accounts, install persistence, access sensitive files, and use the compromised system as a platform for lateral movement. Because this flaw is in the kernel, exploitation artifacts may be sparse and may appear as a short-lived local process followed by privileged actions rather than obvious network-facing exploit traffic.

How to fix it

Apply the Microsoft security updates that address CVE-2021-31979 for all affected Windows versions, including Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 releases, Windows Server 2008, 2012, 2016, 2019, version 2004, and version 20H2 where applicable. Use current cumulative updates or the appropriate servicing stack plus monthly security update for each supported platform. Systems that are out of support should be upgraded to a supported Windows release or covered by applicable Extended Security Updates where available. Prioritize internet-facing servers, remote-access hosts, jump boxes, domain administration workstations, VDI images, and endpoints with high-value credentials. Where immediate patching is not possible, reduce risk by enforcing least privilege, restricting interactive logon, limiting local administrator rights, enabling credential protections, hardening endpoint protection, and closely monitoring for local privilege-escalation behavior. There is no complete configuration-only mitigation for a kernel memory-corruption elevation-of-privilege flaw; patching or retiring affected systems is the durable fix.

How to confirm the fix worked

Confirm that all affected Windows hosts have installed the Microsoft cumulative or security-only update released for this vulnerability or a later superseding update. Validate through centralized patch-management reporting, Microsoft Update compliance data, endpoint inventory, or authenticated vulnerability scanning. Reboot systems where required and verify that update installation succeeded rather than remaining pending. For legacy Windows versions, confirm the exact OS build and servicing branch are supported and that Extended Security Updates, if required, are in place. Run authenticated vulnerability scans after remediation and compare results against the affected Windows versions. For gold images, templates, and offline server images, ensure the update is integrated so newly provisioned systems are not reintroduced vulnerable.

Typical attack path

1. Gain an initial foothold on a vulnerable Windows workstation or server as a low-privileged user.
2. Transfer or stage a local privilege-escalation exploit binary, script, or malware module on the host.
3. Execute the exploit to trigger the Windows Kernel memory-corruption vulnerability.
4. Obtain elevated privileges, commonly NT AUTHORITY\SYSTEM or local administrator-level control.
5. Disable or tamper with security controls, dump credentials, access protected data, or install persistence.
6. Use the elevated host context to move laterally, deploy additional payloads, or complete the broader intrusion objective.

How to detect it

Look for signs of post-foothold local privilege escalation rather than remote exploit traffic. Relevant log sources include Windows Security logs, Sysmon, EDR process telemetry, PowerShell logs, Windows Defender/antivirus events, service-control logs, scheduled task logs, and patch-management records. Hunt for low-privileged user processes spawning or rapidly followed by SYSTEM-level processes, unusual executables launched from user-writable paths such as Downloads, AppData, Temp, or ProgramData, creation of new services or scheduled tasks, unexpected local administrator account changes, token impersonation behavior, credential dumping, LSASS access, and attempts to stop or tamper with security tools. Correlate any suspicious privilege change with prior initial-access events such as phishing payload execution, remote desktop login from unusual sources, web-shell activity, or malware alerts. Because public reporting does not provide a universal exploit filename or network signature for this vulnerability, detection should emphasize behavioral analytics and forensic timelines around privileged actions on unpatched affected hosts.

• NT AUTHORITY\SYSTEM
• \AppData\Local\Temp\
• \AppData\Roaming\
• \Users\Public\
• \ProgramData\
• C:\Windows\Temp\
• Event ID 4672
• Event ID 4688
• Event ID 4697
• Event ID 4720
• Event ID 4732
• Event ID 7045
• Event ID 4698
• sc.exe create
• schtasks.exe /create
• net localgroup administrators
• whoami /priv
• SeDebugPrivilege
• lsass.exe
• comsvcs.dll, MiniDump
• procdump.exe -ma lsass
• rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump

What your security team should do

• Treat remaining exposure as urgent because the vulnerability is in CISA KEV and has known in-the-wild exploitation, even if current EPSS is modest.
• Inventory all affected Windows desktop and server versions and prioritize patching of systems used for administration, remote access, identity services, and critical business operations.
• Verify installation of the relevant Microsoft security update or a later cumulative update; retire or isolate unsupported Windows versions that cannot be patched.
• Hunt for evidence of local privilege escalation followed by suspicious SYSTEM-level activity, especially around the time of initial compromise alerts or malware detections.
• Review endpoint telemetry for unknown executables launched from user-writable directories that are followed by creation of services, scheduled tasks, credential dumping, or security-tool tampering.
• Limit local administrator rights and interactive logon privileges to reduce the likelihood that an initial foothold can be converted into broad compromise.
• Ensure EDR, attack surface reduction rules, credential protection, and tamper protection are enabled on high-risk Windows hosts.
• For any host suspected of exploitation, collect volatile evidence and perform full incident response rather than relying only on patching after the fact.