CVE-2022-21881
Published: 11 January 2022
Summary
CVE-2022-21881 is a high-severity Race Condition (CWE-362) vulnerability in Microsoft Windows 10. Its CVSS base score is 7.0 (High).
Operationally, ranked in the top 8.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Windows Kernel Elevation of Privilege Vulnerability CVE-2022-21881 affects the Windows kernel and is tracked under CWE-362 as a race condition. It carries a CVSS 3.1 score of 7.0 reflecting local access, high attack complexity, and low privileges required to reach high impact on confidentiality, integrity, and availability.
A local attacker with low privileges can exploit the race condition to elevate privileges on an affected system. The vulnerability requires no user interaction and operates within a single scope, allowing the attacker to obtain elevated rights that would otherwise be restricted by the kernel's sandboxing and access controls.
Microsoft security advisories at msrc.microsoft.com and portal.msrc.microsoft.com direct administrators to apply the patches released for CVE-2022-21881. The updates address the race condition in the kernel and are distributed through standard Windows Update channels.
EPSS for the CVE remains flat at 0.0666 with no material increase after disclosure. Public references include a presentation on race conditions against the Windows sandbox, indicating research interest but no documented widespread exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27037
Vulnerability details
Windows Kernel Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Accurate timestamps from internal clocks enable detection of race conditions by providing reliable event ordering in audit logs.
Coordination of concurrent security activities reduces the probability that shared resources will be accessed simultaneously without proper synchronization.