PT-2021-21944 · Canon · Canon Tr150 Print Driver

Published 2021-08-11 · Updated 2022-05-03 · CVE-2021-38085

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Canon TR150 print driver versions 3.71.2.10 and earlier

Description: The issue allows a local attacker to escalate privileges during the add printer process by overwriting CNMurGE.dll. If timed properly, the overwritten DLL will be loaded into a SYSTEM process, resulting in escalation of privileges. This occurs because the driver drops a world-writable DLL into a CanonBJ %PROGRAMDATA% location that gets loaded by printisolationhost (a system process).

Recommendations: For Canon TR150 print driver versions 3.71.2.10 and earlier, consider disabling the printisolationhost system process or restricting access to the CanonBJ %PROGRAMDATA% location as a temporary workaround until a patch is available.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-38085

Affected Products

Canon Tr150 Print Driver

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/canon_driver_privesc.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/163795/Canon-TR150-Driver-3.71.2.10-Privilege-Escalation.html · Exploit
• 🔥 https://youtube.com/watch?v=vdesswZYz-8 · Exploit
• https://osv.dev/vulnerability/CVE-2021-38085 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38085 · Security Note
• https://t.me/cvenotify/19152 · Telegram Post
• https://defcon.org/html/defcon-29/dc-29-speakers.html#baines · Note
• https://t.me/cibsecurity/27184 · Telegram Post
• https://raw.githubusercontent.com/jacob-baines/vuln_disclosure/main/vuln_2021_03.txt · Note