Is CVE-2021-4034 covered by Cortex XDR?

[fhu_omi]

Hi,

does anyone know if the vulnerability CVE-2021-4034 is covered by Cortex XDR Prevent or Pro?

Source: https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation...

Kind regards

FH

[etugriceri]

Dear fhu_omi

There is no content update specifically for CVE-2021-4034 yet but this does not mean that you'll be unprotected. Cortex XDR focuses TTP's and unknowns and You'll be protected by BTP module. 

[fhu_omi]

Dear @etugriceri 

I will test it, then we will see if there existing modules will cover this pointer vulnerability. There is a test program out now: https://pythonrepo.com/repo/kimusan-pkwner

[Luc_Desaulniers]

Hello @fhu_omi, did you get a chance to run some tests?

I ran a test on a test environment with XDR pro enabled and the exploit was allowed to execute without tripping anything on Cortex side initially. I did get a wildfire post detection a few hours later.

I'd like to hear others feedback for this one.

Thanks

[PeteJacobCF]

what version and content release is your asset on?