CVE-2021-36973
📋 TL;DR
This vulnerability allows an authenticated attacker to execute arbitrary code with SYSTEM privileges on affected Windows systems. It affects Windows clients and servers where the Redirected Drive Buffering System (RDBS) is enabled, typically in enterprise environments using folder redirection.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, enabling complete control over the system, data theft, lateral movement, and persistence.
Likely Case
Privilege escalation from a standard user account to SYSTEM, allowing installation of malware, credential harvesting, and bypassing security controls.
If Mitigated
Limited impact if proper access controls, least privilege principles, and network segmentation are implemented, restricting attacker movement.
🎯 Exploit Status
Exploitation requires authenticated user access; public proof-of-concept code exists, making it accessible to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: August 2021 security updates (e.g., KB5005033 for Windows 10 21H1)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36973
Restart Required: Yes
Instructions:
1. Apply the August 2021 Windows security update via Windows Update. 2. For enterprise environments, deploy through WSUS or SCCM. 3. Restart the system after installation.
🔧 Temporary Workarounds
Disable RDBS via Registry
windowsDisables the Redirected Drive Buffering System to mitigate the vulnerability.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Rdbss" /v Start /t REG_DWORD /d 4 /f
Restrict Folder Redirection
windowsLimit use of folder redirection in Group Policy to reduce attack surface.
🧯 If You Can't Patch
- Implement strict access controls and least privilege principles to limit authenticated user access.
- Monitor for suspicious activity related to privilege escalation attempts and RDBS processes.
🔍 How to Verify
Check if Vulnerable:
Check if the August 2021 security update is installed via 'wmic qfe list' or 'systeminfo' command.Check Version:
wmic os get caption, version, buildnumberVerify Fix Applied:
Verify the security update KB number (e.g., KB5005033) is present in installed updates list.📡 Detection & Monitoring
Log Indicators:
- Event ID 4688 for process creation with SYSTEM privileges from non-privileged users
- Unusual RDBS-related process activity in Windows logs
Network Indicators:
- Unusual SMB or network file sharing traffic from compromised systems
SIEM Query:
EventID=4688 AND NewProcessName="*rdbss*" AND SubjectUserName!="SYSTEM"