CVE-2021-38085 Privilege escalation in n/a
A local attacker can overwrite a world-writable DLL to achieve privilege escalation to SYSTEM in the Canon TR150 print driver.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38085?
CVE-2021-38085 is a high-severity vulnerability in n/a, published on 11 Aug 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CNMurGE.dll and, if timed properly, the overwritten DLL will be loaded into a SYSTEM process resulting in escalation of privileges. This occurs because the driver drops a world-writable DLL into a CanonBJ %PROGRAMDATA% location that gets loaded by printisolationhost (a system process).
Weakness: CWE-732
Which versions are affected by CVE-2021-38085?
It affects 1 product.
Products include Canon Pixma Tr150 Firmware.
How do I fix CVE-2021-38085?
No fix has been published for CVE-2021-38085 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-38085 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-38085 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-jp55-93wh-x75g.