Loading vulnerability…
CVE-2021-3438 is a local privilege escalation vulnerability in the legacy SSPORT.SYS printer driver used by numerous HP, Samsung, and Xerox printer products. The vulnerable driver has reportedly been present since 2005 and may be installed during printer software setup, including cases where installation is not completed, after which it is loaded by Windows at boot. The flaw is caused by improper validation of user-supplied IOCTL input in a kernel-mode driver function that accepts data from user mode and uses a user-controlled size parameter in a string copy operation. This unsafe bounds handling can trigger a kernel-space buffer overflow. A local unprivileged attacker who can interact with the device interface exposed by the driver may exploit the flaw to elevate privileges to SYSTEM and potentially achieve kernel-mode code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept (POC) local privilege escalation exploit targeting CVE-2021-3438 (HP/Samsung printer drivers) and CVE-2021-44852 (Biostar RACING GT Evo BS_RCIO64.sys driver) on Windows. The main exploit logic is implemented in 'CVE-2021-3438/exploit.c', which attempts to obtain handles to the vulnerable device drivers (SSPORT.sys and BS_RCIO64.sys), leak the kernel base address of SSPORT.sys, and write a placeholder shellcode payload to kernel memory. The exploit then triggers execution of this payload via a crafted IOCTL to the BS_RCIO64.sys driver. If successful, the exploit launches a SYSTEM-level command prompt. The payload is currently a placeholder and not a real token stealing shellcode, making this a POC rather than a fully weaponized exploit. The code is written in C and is structured as a Visual Studio project, with supporting utility files for leaking kernel addresses and string manipulation. The exploit requires local access, the presence of the vulnerable drivers, and that the NX (No-eXecute) feature is disabled on the target system.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A known HP printer privilege escalation vulnerability that threat actors attempted to exploit via Rundll32 during attacks targeting a financial institution.
A high-severity buffer overflow vulnerability in the SSPORT.SYS printer driver affecting HP, Samsung, and Xerox printers, allowing local privilege escalation to SYSTEM and kernel-mode code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.