Loading vulnerability…
CVE-2021-31955 is a Windows kernel information disclosure vulnerability in ntoskrnl.exe associated with the SuperFetch feature. The flaw allows disclosure of kernel memory information, specifically leaking the _EPROCESS kernel base address for running processes via NtQuerySystemInformation using the SuperfetchPrivSourceQuery information class. In observed exploit chains, the vulnerability was used as a supporting primitive to defeat kernel address secrecy and enable reliable follow-on exploitation of a separate Windows kernel elevation-of-privilege vulnerability. The issue affected recent Windows 10 builds and was used in the wild as part of a Chrome-to-kernel exploit chain.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a local privilege escalation exploit targeting Windows 10 20H2, specifically leveraging CVE-2021-31955, CVE-2015-4077, and CVE-2015-5736. The main exploit logic resides in 'forti_exploit.cpp', which orchestrates the attack by leaking kernel addresses, manipulating kernel memory, and ultimately stealing the SYSTEM token using custom shellcode found in 'token_stealing.asm'. The exploit is operational but not weaponized, as it relies on hardcoded offsets and is not version-independent. The exploit launches a SYSTEM-level command shell upon success. The repository includes standard C++ project files and headers, with the main entry point in 'forti_exploit.cpp'. No network endpoints are involved; the attack vector is purely local, requiring code execution on the target machine. The exploit manipulates specific files in the user's AppData directory as part of its process.
This repository contains a proof-of-concept (POC) exploit for CVE-2021-31955, a Windows kernel information disclosure vulnerability. The main code is in 'CVE-2021-31955/CVE-2021-31955.cpp', which demonstrates how to use the undocumented SystemSuperfetchInformation class with NtQuerySystemInformation to leak kernel EPROCESS addresses for running processes. The exploit is local and requires execution on a vulnerable, unpatched 64-bit Windows system. The project includes standard Visual Studio files for building the application, as well as headers and a README describing the vulnerability and expected output. The exploit does not provide code execution or privilege escalation, but demonstrates kernel address disclosure, which can be used to bypass kernel ASLR in further attacks.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A separate information disclosure vulnerability mentioned as background because PuzzleMaker paired it with CVE-2021-31956; it is not part of the main exploit chain analyzed here.
An information disclosure vulnerability in Windows ntoskrnl.exe related to the SuperFetch feature that leaks EPROCESS kernel addresses for running processes, enabling attackers to bypass kernel address protections and support privilege escalation.
A Windows kernel information disclosure zero-day used as part of a complex exploit chain targeting recent Windows 10 builds.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.