So these vulns weren't needed any more by some 3 letter agency? Or were they being used by someone a 3 letter agency didn't like? Or were about to be?
Security warfare is fascinating to watch from the mud huts.
Security warfare is fascinating to watch from the mud huts.
Acknowledgements: Clément Lecigne of Google’s Threat Analysis Group
–CVE-2021-31955, an information disclosure bug in the Windows Kernel
Acknowledgements: Boris Larin (oct0xor) of Kaspersky Lab
–CVE-2021-31956, an elevation of privilege flaw in Windows NTFS
Acknowledgements: Boris Larin (oct0xor) of Kaspersky Lab
–CVE-2021-33739, an elevation of privilege flaw in the Microsoft Desktop Window Manager
Acknowledgements: Jinquan(@jq0904) with DBAPPSecurity Lieying Lab
Yes. The NSA has disclosed hoarded zero-days to Microsoft when they have fallen into the hands of people they did not like. See the Shadow Brokers incident [1]:
> the critical vulnerabilities for four exploits previously believed to be zero-days were patched in March, exactly one month before a group called Shadow Brokers published Friday's latest installment of weapons-grade attacks
Obviously, the problem with this is that the NSA were unaware their zero-days had fallen into enemy hands until the Shadow Brokers very publicly advertised the fact that they had them.
[1]: https://arstechnica.com/information-technology/2017/04/purpo...
"The NSA did not alert Microsoft about the vulnerabilities, and held on to it for more than five years before the breach forced its hand. The agency then warned Microsoft after learning about EternalBlue's possible theft, allowing the company to prepare a software patch issued in March 2017,[19] after delaying its regular release of security patches in February 2017.[20] On Tuesday, March 14, 2017, Microsoft issued security bulletin MS17-010,[21] which detailed the flaw and announced that patches had been released for all Windows versions that were currently supported at that time
...
Many Windows users had not installed the patches when, two months later on May 12, 2017, the WannaCry ransomware attack used the EternalBlue vulnerability to spread itself"