CVE-2021-31837
📋 TL;DR
A memory corruption vulnerability in McAfee GetSusp's driver file component allows local programs to trigger a buffer overflow, potentially executing arbitrary code or causing a system crash (BSOD). This affects users running GetSusp versions prior to 4.0.0 on their local machines.
💻 Affected Systems
- McAfee GetSusp
📦 What is this software?
Getsusp by Mcafee
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise, arbitrary code execution with SYSTEM privileges, or persistent malware installation.
Likely Case
Local denial of service (BSOD/crash) or limited code execution in the context of the GetSusp process.
If Mitigated
No impact if GetSusp is not installed or has been updated to version 4.0.0+.
🎯 Exploit Status
Exploitation requires local program execution and knowledge of the buffer overflow trigger. No public exploits have been reported.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.0
Vendor Advisory: https://kc.mcafee.com/corporate/index?page=content&id=SB10363
Restart Required: Yes
Instructions:
1. Download GetSusp 4.0.0+ from official McAfee sources. 2. Uninstall previous GetSusp versions. 3. Install the updated version. 4. Restart the system.
🔧 Temporary Workarounds
Uninstall GetSusp
windowsRemove the vulnerable software entirely if not needed
Control Panel > Programs > Uninstall a program > Select McAfee GetSusp > Uninstall
Restrict local execution
windowsImplement application whitelisting to prevent unauthorized local program execution
🧯 If You Can't Patch
- Remove GetSusp from all systems if not essential for operations
- Implement strict endpoint security controls and monitor for suspicious local process behavior
🔍 How to Verify
Check if Vulnerable:
Check GetSusp version: Right-click GetSusp executable > Properties > Details tab > File versionCheck Version:
wmic datafile where name="C:\\Program Files\\McAfee\\GetSusp\\GetSusp.exe" get versionVerify Fix Applied:
Verify version is 4.0.0 or higher using the same method📡 Detection & Monitoring
Log Indicators:
- GetSusp process crashes, unexpected system reboots, GetSusp driver errors in Windows Event Logs
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
EventID=1000 OR EventID=1001 OR EventID=41 AND ProcessName="GetSusp.exe"