CVE-2022-21882

Win32k Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21887.

Recent assessments:

gwillcox-r7 at January 18, 2022 4:35pm UTC reported:

Looks like this is a LPE in win32k that is being exploited in the wild according to Microsoft to let attackers escalate their privileges to SYSTEM. Attack complexity on this is high which is understandable given the history of win32k and the complexities regarding its architecture which was built before modern security mitigations were implemented. With that being said though the finder of this bug, at <https://twitter.com/b2ahex/status/1481233350840893442&gt;, notes that exploitation is easy and that this is a patch bypass for CVE-2021-1732, which was a window object type confusion leading to an OOB (out-of-bounds) write as noted by McAfee’s technical writeup at <https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/technical-analysis-of-cve-2021-1732/&gt;.

Of particular note here is that they credit Big CJTeam of Tianfu Cup and RyeLv aka @b2ahex on Twitter for finding this vulnerability. They note that this was exploited in the wild but the mention of Tianfu Cup is interesting as it suggests this was also reported to China’s government via the Chinese Tianfu Cup hacking competition.

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 3