Expert releases PoC for CVE-2022-21882 Windows local privilege elevation issue

A researcher disclosed an exploit for a Windows local privilege elevation issue (CVE-2022-21882) that allows anyone to gain admin privileges in Windows 10.

The security researchers RyeLv has publicly released an exploit for a Windows local privilege elevation flaw (CVE-2022-21882) that allows anyone to gain admin privileges in Windows 10.

The Win32k elevation of privilege vulnerability was fixed this month as part of the January 2022 Patch Tuesday, it is the result of a bypass for the previously CVE-2021-1732 flaw.

“A local, authenticated attacker could gain elevated local system or administrator privileges through a vulnerability in the Win32k.sys driver.” reads the advisory published by Microsoft.

Now RyeLv published a detailed analysis of the vulnerability that affects all supported support versions of Windows 10.

Using this vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network, create new administrative users, or perform privileged commands.

“Attacker can intercept this callback [xxxClientAllocWindowClassExtraBytes] through hook xxxClientAllocWindowClassExtraBytes in KernelCallbackTable,and use the NtUserConsoleControl method to set the ConsoleWindow flag of the tagWND object, which will modify the window type.” reads the analysis published by RyeLv. “After the final callback, the system does not check whether the window type has changed, and the wrong data is referenced due to type confusion. The difference before and after the flag modified is that before setting the flag, the system thinks that tagWND.WndExtra saves a user_mode pointer; after the flag is set, the system thinks that tagWND.WndExtra is the offset of the kernel desktop heap,and attacker can control this offset, then cause out-of-bounds R&W.”

Regarding the just-fixed CVE-2022-21882:
win32k privilege escalation vulnerability,
CVE-2021-1732 patch bypass,easy to exploit,which was used by apt attacks

— b2ahex (@b2ahex) January 12, 2022

Multiple experts confirmed that the exploits correctly work, including the CERT/CC vulnerability analyst Will Dormann:

Yup. This CVE-2022-21882 PoC works. https://t.co/strDxXktIV pic.twitter.com/cZA5eL8UpK

— Will Dormann (@wdormann) January 28, 2022

quickly tested the CVE-2022-21882 Win10 LPE PoC from @kalendsi before applying KB5009543 (which should patch it). works nicely on my 21H2 19044.1415. https://t.co/gvozRBxeU1 https://t.co/TSPj2PLnNX pic.twitter.com/f0zej818Lf

— an0n (@an0n_r0) January 30, 2022

CVE -2022-21882,Easy to Exploited pic.twitter.com/jvyYSwtHjq

— kalendsi (@kalendsi) January 19, 2022

Administrators that have yet to install January 2022 security updates are recommended to do it as soon as possible to prevent attacks exploiting this issue.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, REvil ransomware)

The post Expert releases PoC for CVE-2022-21882 Windows local privilege elevation issue appeared first on Security Affairs.

Recent Posts
Contact Us

We're not around right now. But you can send us an email and we'll get back to you, asap.

Not readable? Change text. captcha txt