^{CVE-2021-36948:}Windows Update Medic Service Elevation of Privilege Vulnerability allows attackers to gain elevated privileges on affected Windows systems.

Overview

The Windows Update Medic Service vulnerability (CVE-2021-36948) affects multiple versions of Windows operating systems. When successfully exploited, an attacker who has already gained access to a system can elevate their privileges to SYSTEM level, bypassing security controls and gaining complete control over the affected device. This vulnerability is particularly concerning because the Update Medic Service runs with high privileges by default, and exploitation requires minimal user interaction. The vulnerability stems from improper handling of privileged operations within the service, allowing attackers to manipulate the service into executing malicious code with elevated permissions.

Remediation

To address this vulnerability, Microsoft has released security updates as part of their August 2021 Patch Tuesday release. System administrators should apply these patches immediately to all affected systems. The following actions are recommended:

1. Apply the security update provided by Microsoft through Windows Update or Microsoft Update Catalog.
2. Prioritize patching for systems that are internet-facing or otherwise accessible to potential attackers.
3. If patching cannot be performed immediately, consider implementing workarounds such as restricting access to the Windows Update Medic Service or implementing additional access controls.
4. Monitor systems for suspicious activities that might indicate exploitation attempts.
5. Ensure that only necessary user accounts have local administrative privileges on Windows systems.

References

1. Microsoft Security Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36948
2. Microsoft August 2021 Security Updates: https://msrc.microsoft.com/update-guide/
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
4. MITRE CVE Entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36948