CVE-2021-42983
📋 TL;DR
This vulnerability allows local attackers to execute arbitrary code with kernel privileges or cause denial of service via memory corruption in NoMachine Enterprise Client. It affects users running vulnerable versions of the client software. Attackers need local access to exploit this buffer overflow in the IOCTL handler.
💻 Affected Systems
- NoMachine Enterprise Client
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with kernel-level code execution leading to persistent backdoors, data theft, and full control of the affected system.
Likely Case
Privilege escalation from a lower-privileged user to SYSTEM/root access, enabling lateral movement and further exploitation.
If Mitigated
Denial of service causing system crashes or instability if exploitation attempts fail or are partially successful.
🎯 Exploit Status
Requires local access and knowledge of the vulnerable IOCTL handler. No public exploit code has been released as of available information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.7.4 and later
Vendor Advisory: https://www.nomachine.com/
Restart Required: Yes
Instructions:
1. Download NoMachine Enterprise Client version 7.7.4 or later from official website. 2. Uninstall current vulnerable version. 3. Install updated version. 4. Restart the system.
🔧 Temporary Workarounds
Disable NoMachine Client
linuxRemove or disable the NoMachine Enterprise Client if not required
sudo systemctl stop nomachine
sudo systemctl disable nomachine
Restrict Local Access
allImplement strict local access controls and user privilege separation
🧯 If You Can't Patch
- Implement strict user privilege separation to limit potential damage from exploitation
- Monitor systems for unusual process creation or privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check NoMachine version: On Windows - Check installed programs list; On Linux - Run 'nxclient --version' or check package manager; On macOS - Check About in NoMachine menuCheck Version:
nxclient --version (Linux) or check installed programs (Windows)Verify Fix Applied:
Confirm version is 7.7.4 or higher using the same version check methods📡 Detection & Monitoring
Log Indicators:
- Unusual process creation with elevated privileges
- System crashes or instability
- Failed IOCTL requests to NoMachine driver
Network Indicators:
- Local privilege escalation attempts
- Unusual local system activity
SIEM Query:
Process creation where parent process is NoMachine client and privilege level changes