CVE-2022-22047
Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability
Description
CVE-2022-22047 is a privilege escalation vulnerability in the Microsoft Windows Client Server Runtime Subsystem (CSRSS) that allows an attacker to elevate privileges to SYSTEM on affected Windows systems. CSRSS is a critical Windows process responsible for managing console windows and thread creation/deletion, and its compromise grants the attacker the highest level of local system access. CISA has added CVE-2022-22047 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 1.3% (80th percentile), this vulnerability shows above-average exploitation probability among all tracked CVEs.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19360 |
| microsoft | windows 10 1607 | < 10.0.14393.5246 |
| microsoft | windows 10 1809 | < 10.0.17763.3165 |
| microsoft | windows 10 20h2 | < 10.0.19042.1826 |
| microsoft | windows 10 21h1 | < 10.0.19043.1826 |
| microsoft | windows 10 21h2 | < 10.0.19044.1826 |
| microsoft | windows 11 21h2 | < 10.0.22000.795 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5246 |
| microsoft | windows server 2019 | < 10.0.17763.3165 |
| microsoft | windows server 2022 | < 10.0.20348.825 |
| microsoft | windows server 20h2 | < 10.0.19042.1826 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22047(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22047(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CVE-2022-22047 exploits improper privilege management in the Windows Client Server Runtime Subsystem, where the process fails to properly restrict privilege escalation operations. The CSRSS vulnerability allows a local attacker to escalate from standard user privileges to SYSTEM, the highest privilege level on Windows, by exploiting a flaw in how CSRSS manages process privileges and security boundaries.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2022-22047 is a local privilege escalation vulnerability that requires the attacker to already have code execution on the target Windows system. However, the escalation to SYSTEM privileges makes it an extremely valuable post-exploitation tool, as SYSTEM access bypasses all user-level security controls and provides unrestricted access to the entire system. Confidentiality is fully compromised as SYSTEM can access all files, registry keys, and credentials; integrity is at total risk as SYSTEM can modify any system component including security settings; and availability can be disrupted through system manipulation or malware deployment. The vulnerability is particularly dangerous when chained with remote code execution vulnerabilities that provide initial access, as the combination delivers a complete remote-to-SYSTEM attack path.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-22047 in the wild by adding it to the Known Exploited Vulnerabilities catalog on July 12, 2022, with a remediation deadline of August 2, 2022. The vulnerability was addressed in Microsoft's July 2022 Patch Tuesday. With an EPSS score of 1.3% (80th percentile), exploitation probability is above average, indicating active use by threat actors as a privilege escalation component in multi-stage attacks. CSRSS privilege escalation vulnerabilities are highly valued in the attacker ecosystem because they provide reliable SYSTEM-level access on Windows systems.
Remediation
- Apply Microsoft security updates immediately: Install the patches from Microsoft's July 2022 Patch Tuesday that address CVE-2022-22047, as referenced in the Microsoft Security Update Guide.
- Prioritize endpoints with potential initial access vectors: Focus patching on systems that are most likely to have existing compromise or initial access, including user workstations, remote access servers, and internet-facing systems.
- Implement application whitelisting: Deploy application control policies to prevent unauthorized executables from running, which can block the initial code execution required to exploit this local privilege escalation.
- Enable enhanced process monitoring: Configure endpoint detection and response (EDR) solutions to alert on suspicious CSRSS behavior, including unusual child processes spawned by CSRSS or unexpected privilege escalation events.
- Apply the principle of least privilege: Ensure users operate with standard user accounts rather than administrative accounts, which limits the attacker's starting privilege level and may reduce the impact of successful exploitation.
Technical Details
CVE-2022-22047 is a privilege escalation vulnerability in the Windows Client Server Runtime Subsystem (CSRSS), a critical Windows process that runs at SYSTEM privilege level and manages console-based application subsystems. The vulnerability allows a local attacker who already has code execution at a lower privilege level to exploit a flaw in CSRSS to escalate to SYSTEM privileges. CSRSS (csrss.exe) is a protected process that handles critical system functions including process and thread management, console window management, and shutdown procedures. Because CSRSS operates at the highest privilege level, any vulnerability that allows interaction with or manipulation of CSRSS internals can potentially be leveraged for privilege escalation. The local attack vector means the attacker must first achieve code execution through another means, making this vulnerability most commonly used as part of exploit chains where initial access is obtained through a separate remote vulnerability or social engineering attack.
Frequently Asked Questions
Is CVE-2022-22047 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-22047 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 2, 2022. The vulnerability is used as a privilege escalation component in multi-stage attacks. Organizations should apply Microsoft's July 2022 patches immediately.
What products are affected by CVE-2022-22047?
CVE-2022-22047 affects Microsoft Windows through the Client Server Runtime Subsystem (CSRSS). Multiple Windows versions including Windows 10, Windows 11, and Windows Server are potentially affected. Refer to the Microsoft Security Update Guide for the specific list of affected versions.
How do I fix CVE-2022-22047?
Apply the security updates from Microsoft's July 2022 Patch Tuesday that address CVE-2022-22047. Ensure all affected Windows systems are updated through your patch management solution. Implement application whitelisting and enhanced endpoint monitoring as additional defenses.
How severe is CVE-2022-22047?
CVE-2022-22047 is a high-severity privilege escalation vulnerability with an EPSS score of 1.3% (80th percentile) and confirmed active exploitation. While it requires local access, the escalation to SYSTEM privileges provides complete control over the affected Windows system, making it a critical component in attack chains.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.