CVE-2021-42979
📋 TL;DR
This vulnerability in NoMachine Cloud Server allows local attackers to execute arbitrary code with kernel privileges or cause denial of service through memory corruption. It affects users running NoMachine Cloud Server versions between 4.0.346 and 7.7.4. Attackers need local access to exploit the integer overflow in the IOCTL handler.
💻 Affected Systems
- NoMachine Cloud Server
📦 What is this software?
Cloud Server by Nomachine
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with kernel-level code execution leading to persistent backdoors, data theft, and full control of affected systems.
Likely Case
Local privilege escalation allowing attackers to gain SYSTEM/root privileges from a lower-privileged account, potentially leading to lateral movement within the network.
If Mitigated
Denial of service causing system crashes and service disruption if memory corruption occurs without successful code execution.
🎯 Exploit Status
Requires local access and knowledge of IOCTL handling. The vulnerability is well-documented with technical details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.7.4 and later
Vendor Advisory: https://www.nomachine.com/
Restart Required: Yes
Instructions:
1. Download NoMachine Cloud Server version 7.7.4 or later from official website. 2. Stop the NoMachine service. 3. Install the updated version. 4. Restart the service or system.
🔧 Temporary Workarounds
Restrict local access
allLimit local user access to systems running NoMachine Cloud Server to reduce attack surface
Disable unnecessary IOCTL handlers
windowsIf possible, disable or restrict access to vulnerable IOCTL handlers through system policies
🧯 If You Can't Patch
- Implement strict access controls to limit local user accounts on affected systems
- Monitor for unusual privilege escalation attempts and system crashes
🔍 How to Verify
Check if Vulnerable:
Check NoMachine version: On Windows check Add/Remove Programs, on Linux check package manager or run 'nomachine --version'Check Version:
nomachine --version (Linux/macOS) or check installed programs (Windows)Verify Fix Applied:
Verify version is 7.7.4 or higher using the same version check methods📡 Detection & Monitoring
Log Indicators:
- System crashes with memory corruption errors
- Unexpected privilege escalation events
- IOCTL 0x22001B access attempts
Network Indicators:
- No network indicators - local exploit only
SIEM Query:
EventID 4624 (Windows) with privilege changes OR kernel panic/crash logs (Linux)