CVE-2022-21882: Win32k Elevation of Privilege Vulnerability

Overview

Severity
High (CVSS 7)
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Actively Exploited
Exploitation Likelihood
More Likely
Patch Tuesday
2022-Jan
Released
2022-01-11
Last Updated
2022-01-13
EPSS Score
90.07% (percentile: 99.6%)
CISA KEV
Listed — due 2022-02-18

FAQ

What privileges could be gained by an attacker who successfully exploited the vulnerability? A local, authenticated attacker could gain elevated local system or administrator privileges through a vulnerability in the Win32k.sys driver.

Known Exploits (6)

  • Microsoft Win32k Privilege Escalation Vulnerability — added 2022-02-14T21:28:15Z
  • Microsoft Win32k Privilege Escalation Vulnerability — added 2022-02-07T03:45:36Z
  • Microsoft Win32k Privilege Escalation Vulnerability — added 2022-02-03T11:25:14Z
  • Microsoft Win32k Privilege Escalation Vulnerability — added 2022-02-01T17:58:29Z
  • Microsoft Win32k Privilege Escalation Vulnerability — added 2022-01-27T03:44:10Z
  • Microsoft Win32k Privilege Escalation Vulnerability — added 2019-11-10T18:02:31Z

Detection & Weaponization (2 sources)

Maturity: Exploit

  • Metasploit modules: Win32k ConsoleControl Offset Confusion
  • GitHub PoC: 5 repositories

Affected Products (21)

Windows

  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows 10 Version 1909 for 32-bit Systems
  • Windows 10 Version 1909 for x64-based Systems
  • Windows 10 Version 1909 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows Server 2022
  • Windows Server 2022 (Server Core installation)
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows Server, version 20H2 (Server Core Installation)
  • Windows 11 version 21H2 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems

Security Updates (5)

Acknowledgments

<a href="https://twitter.com/b2ahex">RyeLv (@b2ahex)</a>, Big CJTeam of Tianfu Cup

Revision History

  • 2022-01-11: Information published.
  • 2022-01-13: Corrected Active Attack entry to Yes. When this information was originally released, Microsoft was aware of limited, targeted attacks that attempt to exploit this vulnerability.