# CVE-2022-21882: Win32k Window Object Type Confusion

Win32k type confusion via hooked xxxClientAllocWindowClassExtraBytes callback and NtUserConsoleControl setting ConsoleWindow flag yields OOB R/W and kernel token theft for LPE.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Windows
- Credited: RyeLv
- Disclosed: 2022-01-13
- CVE: CVE-2022-21882
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-21882.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-21882
- Tags: domain:desktop impact:privesc kind:incident platform:project-zero sev:high tech:windows technique:chained technique:source-review vuln:memory-corruption vuln:privilege-escalation

**Target:** win32k.sys kernel window object (tagWND) via user-mode GUI callbacks
**Root cause:** Kernel callbacks like xxxMenuWindowProc trigger xxxClientAllocWindowClassExtraBytes; attacker hooks it in KernelCallbackTable and calls NtUserConsoleControl to set the ConsoleWindow flag (0x800), changing tagWND.WndExtra interpretation from user-mode pointer to kernel desktop heap offset. The system never rechecks the flag after the callback returns.
**Steps:**
1. Hook xxxClientAllocWindowClassExtraBytes in KernelCallbackTable
2. Trigger a GUI API path (xxxMenuWindowProc/xxxSBWndProc/xxxSwitchWndProc/xxxTooltipWndProc) that invokes the callback
3. Inside callback call NtUserConsoleControl to set ConsoleWindow flag 0x800 on the tagWND
4. Return; kernel treats WndExtra as desktop-heap offset instead of user pointer -> OOB R/W
5. Overwrite cbWndExtra to 0x0FFFEFFF to widen window extra access
6. Set WS_CHILD on another window and attach a fake menu
7. Leak kernel pointers via GetMenuBarInfo for arbitrary read
8. Use SetWindowLongPtrA to set ExtraBytes of another window for arbitrary write
9. Walk EPROCESS ActiveProcessLinks to find PID 4 system process
10. Copy system token into current process token
**How found:** Code auditing of user-mode callback functions in win32k; recognized the same callback surface as CVE-2021-1732 and checked whether window type/flag could change mid-callback without revalidation.
**Exploitation:** Full LPE: OOB write corrupts cbWndExtra, fake menu + GetMenuBarInfo gives arbitrary read, SetWindowLongPtrA gives arbitrary write, then token swap of current process with SYSTEM (PID 4) token.
**Escalation:** Chains OOB write into arbitrary R/W primitives, then EPROCESS token replacement for SYSTEM privilege escalation.
**Insight:** When auditing win32k user-mode callbacks, check whether object state (like tagWND flags) can be mutated via NtUserConsoleControl during the callback and whether the kernel revalidates it after return; distinguish call paths by stack (xxxCreateWindowEx vs other WndProcs) to find variants.