{"uuid": "eea875f0-2089-4b34-b806-ba033d1f7cfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/hacking_Attack/17273", "content": "Black Hat Ethical Hacking\n16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg 16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows MachinesPost Views: 88 \nReading Time: 1 Minute\nResearchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers (also used by Samsung and Xerox), which impacts hundreds of millions of Windows machines.\nIf exploited, cyberattackers could bypass security products; install programs; view, change, encrypt or delete data; or create new accounts with more extensive user rights.\n\nThe bug (CVE-2021-3438) has lurked in systems for 16 years, researchers at SentinelOne said, but was only uncovered this year. It carries an 8.8 out of 10 rating on the CVSS scale, making it high-severity.\n\nAccording to researchers, the vulnerability exists in a function inside the driver that accepts data sent from User Mode via Input/Output Control (IOCTL); it does so without validating the size parameter. As the name suggests, IOCTL is a system call for device-specific input/output operations.\n\n\u201cThis function copies a string from the user input using \u2018strncpy\u2019 with a size parameter that is controlled by the user,\u201d according to SentinelOne\u2019s analysis, released on Tuesday. \u201cEssentially, this allows attackers to overrun the buffer used by the driver.\u201d\n\nThus, unprivileged users can elevate themselves into a SYSTEM account, allowing them to run code in kernel mode, since the vulnerable driver is locally available to anyone, according to the firm.\n\nThe printer-based attack vector\u00a0is perfect for cybercriminals, according to SentinelOne, since printer drivers are essentially ubiquitous on Windows machines and are automatically loaded on every startup.\nSee Also: Microsoft: New Unpatched Bug in Windows Print Spooler\n\u201cThus, in effect, this driver gets installed and loaded without even asking or notifying the user,\u201d explained the researchers. \u201cWhether you are configuring the printer to work wirelessly or via a USB cable, this driver gets loaded. In addition, it will be loaded by Windows on every boot. This makes the driver a perfect candidate to target since it will always be loaded on the machine even if there is no printer connected.\u201d\n\nWeaponizing the bug might require chaining other vulnerabilities to achieve initial access into an environment. So far, no in-the-wild attacks have been observed.\n\n\u201cWhile we haven\u2019t seen any indicators that this vulnerability has been exploited in the wild up till now, with hundreds of millions of enterprises and users currently vulnerable, it is inevitable that attackers will seek out those that do not take the appropriate action,\u201d researchers warned. How to Fix the HP Printer-Driver BugSince the bug has existed since 2005, it impacts a very long list of printer models, researchers noted; affected models and associated patches can be found here\u00a0and here.\n\nDevice-driver vulnerabilities are not uncommon, so SentinelOne also suggested reducing the attack surface with some best practices, including enforcing strong access control lists (ACLs), which control access to packages, folders, and other elements (such as services, document types and specifications) at the group level. And, it\u2019s a good idea to verify user input and not expose a generic interface to kernel mode operations, they added. See Also: Offensive Security Tool: Veil \u201cWhile HP is releasing a patch (a fixed driver), it should be noted that the certificate has not yet been revoked at the time of writing,\u201d according to SentinelOne. \u201cThis is not considered best practi[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:31.130043Z"}