CVE-2021-23887: mcafee data_loss_prevention_endpoint Improper Privilege Management

Vulnerability summary

CVE-2021-23887 is a high (CVSS 7.8) Improper Privilege Management vulnerability in mcafee data_loss_prevention_endpoint. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.4% of scored vulnerabilities.

Timeline

1. 15-04-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to write to arbitrary controlled kernel addresses. This is achieved by launching applications, suspending them, modifying the memory and restarting them when they are monitored by McAfee DLP through the hdlphook driver.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.