CVE-2021-43463
📋 TL;DR
This vulnerability allows local attackers to execute arbitrary code with SYSTEM privileges by placing a malicious executable in an unquoted service path. It affects systems running Ext2Fsd v0.68 where the Ext2Srv service is installed with an unquoted path containing spaces.
💻 Affected Systems
- Ext2Fsd
📦 What is this software?
Ext2 File System Driver by Ext2 File System Driver Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of persistent malware, data theft, or ransomware deployment.
Likely Case
Local privilege escalation from a lower-privileged user to SYSTEM, allowing attackers to bypass security controls and maintain persistence.
If Mitigated
Limited impact if proper access controls prevent local users from writing to service directories or if the service runs with minimal privileges.
🎯 Exploit Status
Exploit requires local access to create files in service path directories. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch exists. Consider uninstalling Ext2Fsd if not needed, or apply workarounds.
🔧 Temporary Workarounds
Quote Service Path
windowsModify the Ext2Srv service to use quoted paths in the service executable path
sc config Ext2Srv binPath= "\"C:\Program Files\Ext2Fsd\Ext2Srv.exe\""
Remove Write Permissions
windowsRestrict write permissions on directories in the service path to prevent malicious file creation
icacls "C:\Program Files\Ext2Fsd" /deny Users:(OI)(CI)W
🧯 If You Can't Patch
- Uninstall Ext2Fsd if not required for system functionality
- Implement strict access controls to prevent local users from writing to service directories
🔍 How to Verify
Check if Vulnerable:
Check if Ext2Srv service path is unquoted and contains spaces: sc qc Ext2Srv | findstr BINARY_PATH_NAMECheck Version:
Check Ext2Fsd version in Control Panel > Programs and Features or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UninstallVerify Fix Applied:
Verify service path is quoted: sc qc Ext2Srv should show quoted path with spaces📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing service path modifications
- Security logs showing unauthorized file creation in Ext2Fsd directories
Network Indicators:
- No network indicators - local exploitation only
SIEM Query:
EventID=7045 OR (EventID=4688 AND ProcessName LIKE '%Ext2Srv%')