What code changes must be made to handle DCOM hardening? (CVE-2021-26414) (KB5004442)

Question

Our clients are having issues with DCOM errors and the issues appear related to the so-called "DCOM hardening" (CVE-2021-26414) (KB5004442).

I think that the server needs this call to CoInitializeSecurity:

   CoInitializeEx(nullptr, COINIT_APARTMENTTHREADED);  
     
   CoInitializeSecurity(nullptr, -1, nullptr, nullptr,  
   RPC_C_AUTHN_LEVEL_PKT_INTEGRITY,  
   RPC_C_IMP_LEVEL_IMPERSONATE,  
   nullptr, EOAC_NONE, nullptr);  

and the client also needs the same call to CoInitializeSecurity:

   CoInitializeEx(nullptr, COINIT_APARTMENTTHREADED);  
     
   CoInitializeSecurity(nullptr, -1, nullptr, nullptr,  
   RPC_C_AUTHN_LEVEL_PKT_INTEGRITY,  
   RPC_C_IMP_LEVEL_IMPERSONATE,  
   nullptr, EOAC_NONE, nullptr);  

Could someone confirm this, please? Thanks.

[I originally posted this question to https://stackoverflow.com : https://stackoverflow.com/questions/73082676]

Answer 1

Hello,

Welcome to Microsoft Q&A!

According to KB5004442—Manage changes for Windows DCOM Server Security Feature Bypass (CVE-2021-26414), The Client Application is at least RPC_C_AUTHN_LEVEL_PKT_INTEGRITY Authentication-Level with enabling the hardening changes for CVE-2021-26414 And the hardening changes for CVE-2021-26414 make DCOM servers in Windows System enforce an Authentication-Level of RPC_C_AUTHN_LEVEL_PKT_INTEGRITY or higher for activation.
So, the code is OK. Also, You can check DCOM error events in the System log to verify.

Thank you.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.