Vulnerability · Published Apr 15, 2021 · Assigned by trellix
CVE-2021-23887Privilege escalation in McAfee DLP Endpoint for Windows
High 7.8
In plain English
A high-severity privilege mismanagement in McAfee Data Loss Prevention (DLP) Endpoint for Windows from McAfee,LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to write to arbitrary controlled kernel addresses. This is achieved by launching applications, suspending them, modifying the memory and restarting them when they are monitored by McAfee DLP through the hdlphook driver.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| McAfee,LLC | McAfee Data Loss Prevention (DLP) Endpoint for Windows | unspecified – before 10.6.100.41 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://kc.mcafee.com/corporate/index?page=content&id=SB10354 x_refsource_CONFIRM
- https://kc.mcafee.com/corporate/index?page=content&id=SB10357 x_refsource_CONFIRM