{"id":39352,"date":"2021-04-14T10:38:05","date_gmt":"2021-04-14T14:38:05","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=39352"},"modified":"2021-04-14T10:38:05","modified_gmt":"2021-04-14T14:38:05","slug":"cve-2021-28310","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/cve-2021-28310\/39352\/","title":{"rendered":"CVE-2021-28310: A broken window"},"content":{"rendered":"

Kaspersky researchers have found<\/a> a zero-day vulnerability (CVE-2021-28310) in a Microsoft Windows component called Desktop Window Manager (DWM). We believe several threat actors have already exploited the vulnerability. Microsoft just released the patch, and we suggest applying it immediately. Here\u2019s why.<\/p>\n

What is Desktop Window Manager?<\/h2>\n

Pretty much everyone is familiar with the windowed interface of modern operating systems: \u00a0each program opening in a separate window that doesn\u2019t necessarily take up the whole screen. Windows may overlap, for example, one casting a shadow over others as if it were physically blocking the light. In Microsoft Windows, the component responsible for rendering features such as shadows and transparency is Desktop Window Manager.<\/p>\n

To understand why Desktop Window Manager is important in a cybersecurity context, consider that programs don\u2019t just draw their windows on the screen; they put the necessary information in a buffer. Desktop Window Manager grabs that information from each program\u2019s buffer and creates the overall composite view that the user sees. When a user moves one window over another, the open programs don\u2019t know anything about whether their windows should be casting a shadow or having a shadow cast on them, for example. Desktop Window Manager does that job, and as such it is a key service in Windows that has existed in every version of Windows since Vista \u2014 and cannot be deactivated in Windows 8 or later versions.<\/p>\n

Desktop Window Manager\u2019s vulnerability<\/h2>\n

The vulnerability our advanced exploit prevention technology discovered is an elevation of privilege<\/a> vulnerability. That means a program can trick Desktop Window Manager into giving it access that it shouldn\u2019t have. In this case, the vulnerability allowed the attackers to execute arbitrary code on victims\u2019 machines \u2014 it essentially gave them full control over the computers.<\/p>\n

How to avoid CVE-2021-28310 exploitation<\/h2>\n

It\u2019s critical to act quickly. Here\u2019s what you can do:<\/p>\n