CVE-2022-21882
Microsoft Win32k Privilege Escalation Vulnerability
Description
CVE-2022-21882 is a HIGH severity privilege escalation vulnerability in the Microsoft Win32k kernel subsystem that allows a local attacker to elevate privileges to SYSTEM through an out-of-bounds write condition. The flaw affects multiple versions of Windows 10 (1809 through 21H2), Windows 11 21H2, Windows Server 2019, Windows Server 2022, and Windows Server 20H2. Classified under CWE-787 (Out-of-bounds Write), this vulnerability carries a CVSS 3.1 score of 7.0 and an EPSS score of 0.89428 (99.5th percentile), indicating extremely high exploitation activity. CVE-2022-21882 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 18, 2022, though no specific ransomware association is documented. The vulnerability resides in the ConsoleControl functionality of the Win32k driver.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.2452 |
| microsoft | windows 10 1909 | < 10.0.18363.2037 |
| microsoft | windows 10 20h2 | < 10.0.19042.1466 |
| microsoft | windows 10 21h1 | < 10.0.19043.1466 |
| microsoft | windows 10 21h2 | < 10.0.19044.1466 |
| microsoft | windows 11 21h2 | < 10.0.22000.434 |
| microsoft | windows server 2019 | < 10.0.17763.2452 |
| microsoft | windows server 2022 | < 10.0.20348.469 |
| microsoft | windows server 20h2 | < 10.0.19042.1466 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21882(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/166169/Win32k-ConsoleControl-Offset-Confusion-Privilege-Escalation.html(Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21882(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21882(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write (CWE-787) is a vulnerability class that occurs when software writes data beyond the intended boundaries of a memory buffer. This can result from buffer overflows, incorrect index calculations, integer overflow in size computations, or type confusion vulnerabilities. Out-of-bounds writes in kernel-mode drivers are especially dangerous because they allow corruption of kernel memory structures, enabling privilege escalation from user-mode to kernel-mode. The CWE Top 25 consistently ranks Out-of-bounds Write as one of the most dangerous software weaknesses due to its high exploitability and the severity of outcomes.
In CVE-2022-21882, the Win32k kernel-mode driver contains an offset confusion vulnerability in its ConsoleControl handling code. Win32k is the core Windows kernel subsystem responsible for the graphical user interface, window management, and user input processing. The vulnerability occurs when Win32k processes specific console control operations and incorrectly calculates memory offsets, leading to a write operation that targets memory outside the intended buffer. By exploiting this out-of-bounds write in the kernel address space, a local attacker can corrupt kernel data structures to escalate privileges from a standard user account to SYSTEM. Learn more about CWE-787 at turingsecure.com.
Impact Analysis
CVE-2022-21882 carries a CVSS 3.1 score of 7.0 (HIGH) with an Unchanged scope. The High attack complexity reflects the need for specific memory layout conditions to be met for successful exploitation.
Confidentiality (High): Successful privilege escalation to SYSTEM provides the attacker with complete read access to all data on the affected system. This includes all user files, password hashes, cached credentials, encryption keys, and data from all applications. SYSTEM-level access bypasses NTFS file permissions, encrypted folder protections (when the system is running), and other user-level access controls.
Integrity (High): SYSTEM privileges allow the attacker to modify any file, registry key, or system configuration. This includes installing rootkits, modifying system binaries, creating persistent backdoor accounts, altering security policies, and tampering with Windows Event Logs. The attacker can also manipulate security software configurations to disable or bypass endpoint protection products.
Availability (High): With SYSTEM access, the attacker can terminate any process, disable system services, corrupt the operating system, or deploy destructive payloads. The privilege escalation can serve as a precursor to ransomware deployment, where SYSTEM access is needed to encrypt files across all user profiles and disable Volume Shadow Copies.
Scope (Unchanged): The scope is Unchanged as the privilege escalation occurs within the Windows operating system. The escalation from a standard user to SYSTEM, however, effectively removes all access restrictions on the local system. With an EPSS score of 0.89428 at the 99.5th percentile, this vulnerability is among the most actively exploited privilege escalation flaws in the current Windows threat landscape.
Exploit Maturity
Active Exploitation: CVE-2022-21882 has been confirmed as actively exploited in the wild, with CISA adding it to the KEV catalog on February 4, 2022. The vulnerability was patched in Microsoft's January 2022 Patch Tuesday update, and exploitation was detected shortly after disclosure. The Win32k subsystem has historically been one of the most frequently targeted attack surfaces for Windows privilege escalation.
Ransomware Association: CISA's KEV catalog does not flag a specific ransomware association for CVE-2022-21882. However, Win32k privilege escalation vulnerabilities are commonly used as post-exploitation tools in ransomware attack chains, providing the elevated privileges necessary to encrypt files across all user profiles, disable security products, and delete Volume Shadow Copies.
Public Exploits: A public exploit is available on Packet Storm Security, demonstrating the ConsoleControl offset confusion technique for privilege escalation. The availability of a polished, public exploit significantly lowers the barrier to exploitation and enables integration into automated attack frameworks.
EPSS Context: The EPSS score of 0.89428 at the 99.5th percentile indicates extremely high exploitation activity. This score reflects the combination of a publicly available exploit, the widespread deployment of affected Windows versions, and the high value of kernel privilege escalation in multi-stage attack operations.
KEV Remediation Deadline: CISA established a very short remediation deadline of February 18, 2022, just 14 days from the catalog addition date of February 4, 2022, reflecting the urgency of patching this actively exploited vulnerability.
Remediation
-
Apply the January 2022 Microsoft cumulative security update immediately. Install the patch from Microsoft's advisory for CVE-2022-21882 for all affected Windows versions including Windows 10 (1809-21H2), Windows 11 21H2, Windows Server 2019, Server 2022, and Server 20H2. Prioritize this patch deployment as exploitation is confirmed in the wild.
-
Verify patch deployment across all Windows endpoints. Use your organization's patch management system (WSUS, SCCM, Intune, or third-party tools) to confirm that the January 2022 cumulative update has been successfully installed on all managed endpoints. Generate compliance reports to identify any systems that may have failed to apply the update.
-
Deploy endpoint detection rules for Win32k exploitation techniques. Configure EDR and SIEM tools to detect common Win32k exploitation patterns including abnormal system calls to the Win32k driver, unexpected privilege transitions from standard user to SYSTEM, and behavioral indicators associated with the ConsoleControl offset confusion technique.
-
Enforce least privilege access across the organization. Reduce the attack surface by ensuring users operate with standard (non-administrative) accounts for daily work. While CVE-2022-21882 allows escalation from low-privilege accounts, layered security controls including application whitelisting and network segmentation limit the attacker's ability to deliver and execute the exploit payload.
-
Enable Windows Credential Guard and Virtualization-Based Security (VBS). On supported hardware, enable Credential Guard and VBS to protect critical credentials and security-sensitive code from kernel-level attacks. These features use hardware virtualization to isolate sensitive operations from the Windows kernel, providing defense-in-depth against privilege escalation vulnerabilities.
-
Monitor for post-exploitation activity on compromised systems. If exploitation is suspected, investigate for indicators of SYSTEM-level compromise including new local administrator accounts, modifications to security software configurations, unexpected scheduled tasks, and evidence of credential dumping tools such as mimikatz or similar utilities.
Technical Details
CVE-2022-21882 is a privilege escalation vulnerability in the Win32k kernel-mode driver caused by an offset confusion condition in the ConsoleControl handling code. Win32k (win32kfull.sys and win32kbase.sys) is the kernel subsystem responsible for Windows GUI operations, including window management, graphics rendering, and console operations.
The vulnerability occurs in the code path that handles ConsoleControl operations. When processing specific console control requests, the Win32k driver incorrectly calculates a memory offset, causing a subsequent write operation to target a memory location outside the intended buffer boundaries. This out-of-bounds write in kernel memory can be leveraged by an attacker to corrupt adjacent kernel data structures, ultimately enabling arbitrary privilege escalation.
The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a local attack vector requiring low privileges (any authenticated user) and no user interaction. The High attack complexity reflects that successful exploitation depends on winning a race condition or achieving a specific kernel memory layout, which may require multiple attempts but is reliably achievable with the publicly available exploit. The scope is Unchanged, but the resulting SYSTEM privileges provide complete control over the local system.
The exploit technique involves triggering the ConsoleControl operation with carefully crafted parameters that cause the offset miscalculation. By controlling the data written through the out-of-bounds write, the attacker can modify kernel objects such as process tokens to elevate their privileges to SYSTEM. The root cause is an arithmetic error in the offset calculation logic of the ConsoleControl handler, where a field used for indexing is not properly validated against the actual buffer size. Microsoft addressed this in the January 2022 cumulative update by adding proper bounds validation to the affected ConsoleControl code path.
Frequently Asked Questions
What is CVE-2022-21882?
CVE-2022-21882 is a privilege escalation vulnerability in the Microsoft Win32k kernel-mode driver caused by an offset confusion condition in the ConsoleControl handling code. It allows any local user with low privileges to escalate to SYSTEM-level access on affected Windows systems. The vulnerability carries a CVSS 3.1 score of 7.0 (HIGH) and affects Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022.
Which Windows versions are affected by CVE-2022-21882?
CVE-2022-21882 affects Windows 10 versions 1809 through 21H2, Windows 11 21H2, Windows Server 2019, Windows Server 2022, and Windows Server 20H2. Specific build numbers are documented in Microsoft's advisory. The vulnerability was patched in the January 2022 cumulative security update. Systems running any of these Windows versions without the January 2022 or later cumulative update remain vulnerable.
How severe is CVE-2022-21882?
CVE-2022-21882 is rated HIGH with a CVSS 3.1 score of 7.0 and has an EPSS score of 0.89428 at the 99.5th percentile, placing it among the most actively exploited vulnerabilities. It is listed in CISA's KEV catalog with a 14-day remediation deadline, and a public exploit demonstrating the ConsoleControl offset confusion technique is available on Packet Storm Security. The vulnerability enables complete SYSTEM-level compromise of affected Windows systems.
How do I fix CVE-2022-21882?
Apply the Microsoft January 2022 cumulative security update for all affected Windows versions. Verify patch deployment across all endpoints using your patch management system. Additionally, deploy EDR detection rules for Win32k exploitation techniques, enforce least-privilege access policies, and enable Windows Credential Guard and Virtualization-Based Security on supported hardware to provide defense-in-depth against kernel privilege escalation attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.