KnowSafe 安全预警：KnowSafe 安全团队监测到编号 AVD-2022-21882 的安全漏洞（危害等级：高危）已公开披露，相关用户应尽快排查并完成修复。
漏洞介绍
攻击者在用户模式调用相关的GUI API来进行kernel调用，如xxxMenuWindowProc、xxxSBWndProc、xxxSwitchWndProc和xxxTooltipWndProc。这些kernel函数调用会触发xxxClientAllocWindowClassExtraBytes回调。攻击者可以通过hook KernelCallbackTable 中的xxxClientAllocWindowClassExtraBytes来拦截回调，使用NtUserConsoleControl 方法来设置tagWND 对象的ConsoleWindow flag，这一步操作可以修改窗口类型。
回调后，系统不会检查窗口的类型是否修改，由于类型混淆会导致错误的数据被应用。Flag修改前系统会将tagWND.WndExtra保存为一个用户模式指针，flag设置后，系统会将tagWND.WndExtra 看作为kernel desktop heap的偏移量，攻击者控制了该偏移量后，就可以引发越界读和写。该漏洞利用可以实现权限提升。
受影响系统：
Windows 10 Version 21H1 for 32-bit Systems
Windows Server 2022 (Server Core installation)
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows Server 2019 (Server Core installation)
Windows 10 Version 1909 for 32-bit Systems
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows Server version 20H2 (Server Core Installation)
Windows 11 for x64-based Systems
Windows 11 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
影响范围
官方公告未列出受影响软件明细，请结合自身业务使用的组件版本进行排查。
解决方案
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21882
参考信息
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21882
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21882
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21882
KnowSafe 将持续跟踪该漏洞的利用情况与修复进展，如需漏洞管理与应急响应支持，欢迎联系 KnowSafe 安全团队。