Local Privilege Escalation in Erlang/OTP Prior to Version 23.2.3

CVE-2021-29221

What is CVE-2021-29221?

A local privilege escalation issue has been identified in Erlang/OTP, which affects versions prior to 23.2.3. This vulnerability can be exploited by a local attacker through the manipulation of file permissions within an existing installation's directory. Under certain conditions on the Windows operating system, an attacker may hijack the accounts of other users running Erlang applications or compel a service operating under 'erlsrv.exe' to execute arbitrary code with Local System privileges. The exploitation of this vulnerability necessitates unsafe filesystem permissions.

References