Inside Win32k Exploitation: Analysis of CVE-2022-21882 and CVE-2021-1732
Summary: Unit 42 analyzed two Windows Win32k privilege escalation vulnerabilities, CVE-2021-1732 and CVE-2022-21882, both of which abuse xxxClientAllocWindowClassExtraBytes and NtUserConsoleControl to overwrite the tagWND.cbWndExtra field of an adjacent window and build arbitrary read/write primitives. The researchers conclude the patch Microsoft issued for CVE-2021-1732 was not sufficient to prevent CVE-2022-21882, which was discovered by RyeLv at the Tianfu Cup in October 2021 and patched in January 2022.
What's compelling: Both exploits are data-only attacks that copy the NT/AUTHORITY SYSTEM token into the attacker's process without executing any attacker-controlled code, a technique the researchers say is becoming more common as modern exploit mitigations get harder to bypass. A patch that closes one Win32k flaw did not stop a near-identical one, so a security leader should assume a fixed vulnerability in this area may have a sibling still open.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-1732CVE-2022-21882
- Related
- Inside Win32k Exploitation: Background on Implementations of Win32k and Exploitation Methodologies Cyber Risks ·2022 0-day In-the-Wild Exploitation…so far Cyber Risks ·CVE-2022-21882: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Feb 04, 2022