CVE-2021-31847 Improper privilege management in repair process of MA for Windows
A local attacker can exploit improper access control in the repair process to execute arbitrary code with system privileges via DLL preloading.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-31847?
CVE-2021-31847 is a high-severity vulnerability in McAfee,LLC McAfee Agent for Windows, published on 22 Sep 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and the ability to execute arbitrary code as the system user, through not correctly protecting a temporary directory used in the repair process and not checking the DLL signature.
Which versions are affected by CVE-2021-31847?
It affects 1 product.
Products include Mcafee Agent.
How do I fix CVE-2021-31847?
No fix has been published for CVE-2021-31847 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-31847 being exploited?
There is no known exploitation of CVE-2021-31847 in the wild and no public exploit code.
Other vulnerabilities in McAfee,LLC McAfee Agent for Windows
- CVE-2018-6703 Remote Logging functionality had a use after free vulnerability in McAfee Agent
- CVE-2022-1258 SQL injection vulnerability in McAfee Agent's ePO extension
- CVE-2022-2313 DLL high jacking in Trellix Agent
- CVE-2022-1256 Improper Privilege Management in McAfee Agent for Windows
- CVE-2022-0166 Privilege escalation vulnerability in McAfee Agent
Sources
Also known as GHSA-4h6j-v5px-xwg7.