# CVE-2021-1732: Windows win32k flag setting out of sync in xxCreateWindowEx

win32k xxxCreateWindowEx callback desyncs tagWND.WndExtra offset flag, letting attacker turn WndExtra into an unchecked kernel offset for OOB read/write and SYSTEM privilege escalation.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Windows
- Credited: JinQuan, MaDongZe, TuXiaoYi, and LiHao of DBAPPSecurity Co., Ltd
- Disclosed: 2021-02-10
- CVE: CVE-2021-1732
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2021/CVE-2021-1732.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2021-1732
- Tags: domain:desktop impact:privesc kind:incident platform:project-zero sev:high tech:windows technique:chained technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** win32kfull!xxxCreateWindowEx / NtUserConsoleControl callback
**Root cause:** xxxClientAllocWindowClassExtraBytes callback lets user mode call NtUserConsoleControl to set tagWND.WndExtra as an offset with a flag; NtCallbackReturn then overwrites WndExtra with an arbitrary value without clearing the flag, so kernel treats it as an unchecked offset.
**Steps:**
1. Create window with WndExtra so xxxCreateWindowEx invokes xxxClientAllocWindowClassExtraBytes callback into user mode.
2. In callback call `NtUserConsoleControl` with current window handle to set WndExtra as offset and set flag.
3. Call `NtCallbackReturn` with arbitrary value; kernel overwrites tagWND.WndExtra but flag stays set.
4. Kernel uses unchecked offset for heap addressing -> OOB read/write.
5. Leak tagWND offset via `HMValidateHandle`; `SetWindowLongW` cbWndExtra=0xfffffff for OOB primitive.
6. OOB-write window1 dwStyle|=WS_CHILD, replace window2 spmenu with fake spmenu.
7. Arbitrary read via fake spmenu + `GetMenuBarInfo`; arbitrary write via window0/window1 + `SetWindowLongPtrA`.
8. Leak kernel addr from spmenu, find EPROCESS, walk ActiveProcessLinks, swap current Token with SYSTEM Token.
**How found:** Auditing possible flag changes before/after win32k callback functions, especially APIs callable during the callback that mutate kernel structure flags.
**Exploitation:** Attacker in user mode abuses the callback to desync WndExtra flag, gains OOB read/write, builds arbitrary read/write primitives via fake spmenu and SetWindowLongPtrA, then walks EPROCESS ActiveProcessLinks to swap the current process token with SYSTEM token for privilege escalation.
**Escalation:** Chained OOB primitive into arbitrary read/write, then token theft for SYSTEM.
**Insight:** When auditing win32k callbacks (xxxClientAllocWindowClassExtraBytes etc.), check whether user-callable APIs like NtUserConsoleControl can flip a structure flag mid-callback and whether the post-callback return value write clears that flag.