CVE-2021-1640: 
vulnerability analysis and mitigation

CVE-2021-1640 is a Windows Print Spooler Elevation of Privilege Vulnerability that was discovered and reported on December 4, 2020. The vulnerability affects various versions of Microsoft Windows operating systems and was publicly disclosed on April 29, 2021 (ZDI Advisory).

The vulnerability exists within the Print Spooler service and allows local attackers to create a denial-of-service condition on affected installations of Microsoft Windows. The specific flaw involves a Time-Of-Check Time-Of-Use condition where attackers can abuse the Print Spooler service to delete files by creating a directory junction. The vulnerability has been assigned a CVSS score of 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) (ZDI Advisory).

When exploited, this vulnerability can lead to a denial-of-service condition on the system and potential elevation of privileges. An attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability (ZDI Advisory).

The vulnerability requires local access and low privileges to exploit. An attacker must first gain the ability to execute low-privileged code on the target system before they can leverage this vulnerability (ZDI Advisory).

Microsoft has released security updates to address this vulnerability. The fixes are available through various KB updates including KB5000802, KB5000803, KB5000807, KB5000808, KB5000809, KB5000822, KB5000840, and KB5000853 for different versions of Windows (Rapid7).