Inside Win32k Exploitation: Background on Implementations of Win32k and Exploitation Methodologies
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-1732 | Out-of-Bounds Write Local Privilege Escalation in Microsoft Win32k (CVE-2021-1732) | 7.8 | 78% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-1732 | The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to… | 6.5 | <1% | PoC | |
| CVE-2022-21882 | Out-of-Bounds Write LPE in Microsoft Win32k on Windows 10/11 and Windows Server | 7.8 | 59% | KEVRansomware | KEV |
From the original article
14 min read at unit42.paloaltonetworks.com
In late January 2022, several reports on social media indicated that a new Microsoft Windows privilege escalation vulnerability ( CVE-2022-21882 ) was being exploited in the wild. These reports prompted us to do an analysis of CVE-2022-21882, which turned out to be a vulnerability in the Win32k. sys user-mode callback function xxxClientAllocWindowClassExtraBytes .
By Shawn Westfall · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.