Wrong permissions on Windows registry files let normal users read password hashes through shadow copies. Installing the update alone was not enough.
Publicly disclosed: 20 July 2021
In July 2021 researchers noticed that on Windows 10 and 11 the files holding the local password database (SAM) and other sensitive registry hives were readable by ordinary users. Through Volume Shadow Copies, a non-admin user could copy them and extract password hashes to become an administrator. Microsoft published guidance on 20 July 2021 and fixed the permissions in August.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2021-36934 | High, CVSS 7.8 (privilege escalation) | Windows 10 (1809 and later), Windows 11 | August 2021 updates + deleting existing shadow copies |
The update did not change shadow copies that already existed. Microsoft advised restricting access to the files and deleting old shadow copies, then creating a new restore point. Note: deleting shadow copies also removes restore points — make sure you have other backups first.
vssadmin list shadows
icacls %windir%\system32\config\*.* /inheritance:e
vssadmin delete shadows /for=c: /quietSources: Microsoft CVE-2021-36934, NVD CVE-2021-36934.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.