Windows Win32k Kernel Privilege Escalation Vulnerability Cve 2022 21882

Windows Win32k kernel privilege escalation vulnerability CVE-2022-21882

Vulnerability Description

CVE-2022-21882 is a bypass of the CVE-2021-1732 vulnerability, which is a type of obfuscation vulnerability in win32k drivers.

Attackers can call related GUI APIs in user_mode, such as xxxMenuWindowProc, xxxSBWndProc, xxxSwitchWndProc, xxxTooltipWndProc, etc. These kernel functions will trigger callbacks xxxClientAllocWindowClassExtraBytes.

After the final callback, the system does not check whether the window type has changed, and the wrong data is referenced due to type obfuscation.

Vulnerability Impact

Product	CPU Architecture	Version	Update	Tested
Windows 10	x86/x64/ARM64	1809
Windows 10	x86/x64/ARM64	1909
Windows 10	x86/x64/ARM64	20H2
Windows 10	x86/x64/ARM64	21H1
Windows 10	x86/x64/ARM64	21H2
Windows 11	x64/ARM64
Windows Server 2019
Windows Server 2022
Windows Server		20H2

Vulnerability reappears

Download the POC file and run it in Windows

Vulnerability POC