CVE-2022-21882
Published: 11 January 2022
Summary
CVE-2022-21882 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 7.0 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2022-21882 is a Win32k elevation-of-privilege vulnerability in the Windows kernel-mode driver that implements the Win32 subsystem. The flaw is an out-of-bounds write (CWE-787) that can be triggered locally, carrying a CVSS 3.1 score of 7.0 under the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
An attacker who already possesses a low-privileged local account can exploit the condition to obtain SYSTEM-level privileges on an affected Windows system. Public exploit code demonstrating offset confusion in the ConsoleControl path has been published, confirming that the vulnerability can be reached without user interaction once local access is obtained.
Microsoft security advisories direct administrators to apply the patches released in the January 2022 Patch Tuesday cycle; the updates are available through Windows Update and the Microsoft Update Catalog. The vulnerability is also listed in CISA’s Known Exploited Vulnerabilities catalog, indicating confirmed in-the-wild exploitation.
EPSS scores have remained elevated, with a current value of 0.8914 and a recorded peak of 0.9045.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-27038
Vulnerability details
Win32k Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 04 February 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patches that close the Win32k out-of-bounds-write flaw.
Limits the initial low-privilege context an attacker must obtain before the Win32k escalation can succeed.
Enables detection of anomalous Win32k ConsoleControl or offset-confusion behavior associated with exploitation attempts.