CVE-2022-41125
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
Description
CVE-2022-41125 is an elevation of privilege vulnerability in the Windows CNG Key Isolation Service caused by an out-of-bounds write flaw. The Windows Cryptography Next Generation (CNG) Key Isolation Service is a critical component responsible for isolating and protecting cryptographic private keys. A locally authenticated attacker with low privileges can exploit this vulnerability to gain SYSTEM-level access on affected Microsoft Windows systems. CVE-2022-41125 has been added to CISA's Known Exploited Vulnerabilities catalog due to confirmed active exploitation, affecting Windows versions from 8.1 through Windows 11 and multiple server editions.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19567 |
| microsoft | windows 10 1607 | < 10.0.14393.5501 |
| microsoft | windows 10 1809 | < 10.0.17763.3650 |
| microsoft | windows 10 20h2 | < 10.0.19042.2251 |
| microsoft | windows 10 21h1 | < 10.0.19043.2251 |
| microsoft | windows 10 21h2 | < 10.0.19044.2251 |
| microsoft | windows 10 22h2 | < 10.0.19045.2251 |
| microsoft | windows 11 21h2 | < 10.0.22000.1219 |
| microsoft | windows 11 22h2 | < 10.0.22621.819 |
| microsoft | windows 8.1 | - |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5501 |
| microsoft | windows server 2019 | < 10.0.17763.3650 |
| microsoft | windows server 2022 | < 10.0.20348.1249 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41125(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41125(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
In CVE-2022-41125, the out-of-bounds write vulnerability resides in the Windows CNG Key Isolation Service, where improper bounds checking during memory operations allows an attacker to write data beyond allocated buffer limits. Exploiting this memory corruption in the context of a privileged cryptographic service enables escalation to SYSTEM-level privileges.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2022-41125 carries a CVSS v3.1 score of 7.8 (High severity), indicating a serious local privilege escalation with full system compromise potential. Attack Vector (Local): An attacker needs local access to the target system, requiring an initial compromise through another vector such as phishing, social engineering, or a separate vulnerability. Attack Complexity (Low): Exploitation is straightforward once local access has been obtained, requiring no specialized conditions or race conditions. Privileges Required (Low): Only standard user-level credentials are needed, making exploitation accessible to any authenticated user on the system. User Interaction (None): No additional user action is required for exploitation. Confidentiality, Integrity, and Availability (all High): Successful exploitation results in SYSTEM-level access, enabling full read/write access to all data, the ability to install or modify programs, and complete control over system availability. The EPSS score of 0.71% (72nd percentile) indicates a moderate probability of exploitation, though the confirmed active exploitation in CISA's KEV catalog demonstrates that threat actors are already leveraging this vulnerability in real-world attacks.
Exploit Maturity
Active exploitation of CVE-2022-41125 has been confirmed by CISA, which added this Windows CNG Key Isolation Service privilege escalation to its Known Exploited Vulnerabilities catalog with a remediation deadline of December 9, 2022. While the ransomware association is currently listed as Unknown, the privilege escalation nature of this vulnerability makes it a valuable component in multi-stage attacks. The EPSS score of 0.71% (72nd percentile) indicates moderate exploitation probability, but the confirmed KEV listing demonstrates that sophisticated threat actors have already incorporated this vulnerability into their toolkits. No public proof-of-concept exploit code has been identified in the available references, suggesting exploitation may be limited to advanced threat groups.
Remediation
- Apply Microsoft security updates immediately as directed by the vendor advisory at the Microsoft Security Response Center. CISA requires federal agencies to apply mitigations by December 9, 2022, or discontinue use of the affected product.
- Patch all affected Windows versions, including Windows 8.1, Windows 10 (versions 1507, 1607, 1809, 20H2, 21H1, 21H2, 22H2), Windows 11 (21H2, 22H2), and Windows Server 2012, 2016, 2019, and 2022. Prioritize systems that handle sensitive cryptographic operations.
- Implement network segmentation and access controls to limit lateral movement from compromised endpoints. Restrict local login capabilities to only authorized users and monitor for unusual authentication patterns on critical systems.
- Deploy endpoint detection and response (EDR) solutions configured to detect privilege escalation attempts, particularly anomalous behavior involving the CNG Key Isolation Service (KeyIso). Monitor for unexpected SYSTEM-level process creation and unusual access to cryptographic key stores.
- Enforce least-privilege principles across the environment by removing unnecessary local administrator rights, implementing application control policies, and regularly auditing user privileges to minimize the impact of initial compromise.
Technical Details
CVE-2022-41125 exploits an out-of-bounds write vulnerability (CWE-787) in the Windows CNG Key Isolation Service (lsass.exe/keyiso.dll), which is the component responsible for process isolation of cryptographic private keys. The vulnerability occurs when the service improperly validates buffer boundaries during memory operations, allowing crafted input to write beyond allocated memory regions. With a Local Attack Vector and Low Attack Complexity, an authenticated user with only Low Privileges can trigger the memory corruption without requiring any user interaction. The CNG Key Isolation Service runs under the Local System account, meaning successful exploitation of the out-of-bounds write allows the attacker to execute code with the highest privilege level on the system. This is particularly concerning because the service is integral to Windows cryptographic operations, and its compromise can undermine the integrity of the entire cryptographic subsystem including certificate stores and key material.
Frequently Asked Questions
Is CVE-2022-41125 being actively exploited?
Yes, CVE-2022-41125 is being actively exploited in the wild. CISA has confirmed active exploitation and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 9, 2022. The ransomware association is currently listed as Unknown.
What products are affected by CVE-2022-41125?
CVE-2022-41125 affects Microsoft Windows 8.1, Windows 10 (versions 1507, 1607, 1809, 20H2, 21H1, 21H2, and 22H2), Windows 11 (versions 21H2 and 22H2), and Windows Server 2012, 2016, 2019, and 2022. All supported editions of these operating systems are vulnerable.
How do I fix CVE-2022-41125?
Apply the latest security updates from Microsoft available through the Microsoft Security Response Center advisory. Ensure all affected systems are patched promptly, implement EDR solutions to detect exploitation attempts, and enforce least-privilege access controls to minimize the impact of potential compromise.
How severe is CVE-2022-41125?
CVE-2022-41125 has a CVSS v3.1 score of 7.8 (High severity) with complete impact across confidentiality, integrity, and availability. The EPSS score of 0.71% (72nd percentile) reflects a moderate exploitation probability, though confirmed active exploitation in CISA's KEV catalog elevates the practical risk significantly.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.