CVE-2021-24092: Microsoft Defender Elevation of Privilege Vulnerability

Overview

Severity

High (CVSS 7.8)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2021-Feb

Released

2021-02-09

EPSS Score

0.41% (percentile: 61.6%)

FAQ

References Identification Last version of the Microsoft Malware Protection Engine affected by this vulnerability Version 1.1.17700.4 First version of the Microsoft Malware Protection Engine with this vulnerability addressed Version 1.1.17800.5 Why is no action required to install this update? In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner. For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating. Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment. How often are the Microsoft Malware Protection Engine and malware definitions updated? Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed. Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time. What is the Microsoft Malware Protection Engine? The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispywar

Affected Products (46)

System Center

• Microsoft Endpoint Protection
• Microsoft System Center Endpoint Protection
• Microsoft System Center 2012 R2 Endpoint Protection
• Microsoft Security Essentials
• Microsoft System Center 2012 Endpoint Protection
• Windows Defender on Windows 10 Version 1803 for 32-bit Systems
• Windows Defender on Windows 10 Version 1803 for x64-based Systems
• Windows Defender on Windows 10 Version 1803 for ARM64-based Systems
• Windows Defender on Windows 10 Version 1809 for 32-bit Systems
• Windows Defender on Windows 10 Version 1809 for x64-based Systems
• Windows Defender on Windows 10 Version 1809 for ARM64-based Systems
• Windows Defender on Windows Server 2019
• Windows Defender on Windows Server 2019 (Server Core installation)
• Windows Defender on Windows 10 Version 1909 for 32-bit Systems
• Windows Defender on Windows 10 Version 1909 for x64-based Systems
• Windows Defender on Windows 10 Version 1909 for ARM64-based Systems
• Windows Defender on Windows Server, version 1909 (Server Core installation)
• Windows Defender on Windows 10 Version 1903 for 32-bit Systems
• Windows Defender on Windows 10 Version 1903 for x64-based Systems
• Windows Defender on Windows 10 Version 1903 for ARM64-based Systems
• Windows Defender on Windows Server, version 1903 (Server Core installation)
• Windows Defender on Windows 10 Version 2004 for 32-bit Systems
• Windows Defender on Windows 10 Version 2004 for ARM64-based Systems
• Windows Defender on Windows 10 Version 2004 for x64-based Systems
• Windows Defender on Windows Server, version 2004 (Server Core installation)
• Windows Defender on Windows 10 Version 20H2 for 32-bit Systems
• Windows Defender on Windows 10 Version 20H2 for ARM64-based Systems
• Windows Defender on Windows Server, version 20H2 (Server Core Installation)
• Windows Defender on Windows 10 for 32-bit Systems
• Windows Defender on Windows 10 for x64-based Systems
• Windows Defender on Windows 10 Version 1607 for 32-bit Systems
• Windows Defender on Windows 10 Version 1607 for x64-based Systems
• Windows Defender on Windows Server 2016
• Windows Defender on Windows Server 2016 (Server Core installation)
• Windows Defender on Windows 7 for 32-bit Systems Service Pack 1
• Windows Defender on Windows 7 for x64-based Systems Service Pack 1
• Windows Defender on Windows 8.1 for 32-bit systems
• Windows Defender on Windows 8.1 for x64-based systems
• Windows Defender on Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Defender on Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Defender on Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Defender on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Defender on Windows Server 2012
• Windows Defender on Windows Server 2012 (Server Core installation)
• Windows Defender on Windows Server 2012 R2
• Windows Defender on Windows Server 2012 R2 (Server Core installation)

Acknowledgments

Kasif Dekel (<a href="https://twitter.com/kasifdekel">@kasifdekel</a>) of SentinelOne

Revision History

• 2021-02-09: Information published.