CVE-2021-34458CriticalCVSS 9.9
Windows Kernel Remote Code Execution Vulnerability
🔗 CVE IDs covered (1)
📋 Description
How do I know if I'm affected by this vulnerability? This issue allows a single root input/output virtualization (SR-IOV) device which is assigned to a guest to potentially interfere with its Peripheral Component Interface Express (PCIe) siblings which are attached to other guests or to the root. You will be vulnerable if you implement the following: Your Windows instance is hosting virtual machines Your Server includes the required hardware with SR-IOV devices
🎯 Affected products6
- Windows Server 2016
- Windows Server 2016 (Server Core installation)
- Windows Server 2019
- Windows Server 2019 (Server Core installation)
- Windows Server, version 2004 (Server Core installation)
- Windows Server, version 20H2 (Server Core Installation)
✅ Remediation
KB5004244 (Security Update) — fixed build 10.0.17763.2061 KB5004237 (Security Update) — fixed build 10.0.19041.1110 KB5004237 (Security Update) — fixed build 10.0.19042.1110 KB5004238 (Security Update) — fixed build 10.0.14393.4530
🔗 References (7)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34458
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5004244
- referencehttps://support.microsoft.com/help/5004244
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5004237
- referencehttps://support.microsoft.com/help/5004237
- patchhttps://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5004238
- referencehttps://support.microsoft.com/help/5004238