Cyber Risks · Unit 42 Palo Alto Networks

Inside Win32k Exploitation: Background on Implementations of Win32k and Exploitation Methodologies

Summary: In late January 2022, social media reports indicated a new Windows privilege escalation vulnerability, CVE-2022-21882, was being exploited in the wild; Unit 42 traced it to the Win32k.sys user-mode callback function xxxClientAllocWindowClassExtraBytes, a flaw similar to CVE-2021-1732, which Microsoft had patched in 2021. The analysis found both are data-only exploits that copy the NT/Authority System privilege token to the exploit process, and Unit 42's writeup covers Win32k internals, user-mode callbacks, and window structures as background.
What you should know: The patch Microsoft shipped for CVE-2021-1732 did not stop CVE-2022-21882, so a fix for one Win32k callback flaw left the same privilege-escalation path open to attackers in the wild.

Read the original at Unit 42 Palo Alto Networks ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2021-1732 CVE-2022-1732 CVE-2022-21882
Related: Inside Win32k Exploitation: Analysis of CVE-2022-21882 and CVE-2021-1732 Cyber Risks ·
2022 0-day In-the-Wild Exploitation…so far Cyber Risks ·
CVE-2022-21882: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Feb 04, 2022