# CVE-2022-41073: Windows Activation Contexts EoP

User remaps C: drive via symlink; CSRSS builds activation context under impersonation from attacker-controlled SxS manifest, loading arbitrary DLL as SYSTEM.

- Payout: Real-world hack
- Severity: high
- Program: Windows
- Credited: Maddie Stone & James Forshaw
- Disclosed: 2022-11-08
- CVE: CVE-2022-41073
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-41073.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-41073
- Tags: impact:privesc impact:rce kind:incident platform:project-zero sev:high technique:chained technique:incomplete-fix vuln:path-traversal vuln:privilege-escalation

**Target:** CSRSS activation context generation / winspool!LoadNewCopy via printfilterpipelinesvc
**Root cause:** During impersonation, CSRSS resolves side-by-side assembly manifests using the impersonated process's DOS device map, so a user-remapped C: drive causes attacker-controlled manifests to be read instead of C:\Windows\WinSxS.
**Steps:**
1. Start printfilterpipelinesvc.exe (SYSTEM local service).
2. Create a symbolic link remapping the C: drive root to an attacker-writable path.
3. Place a modified PrintConfig.dll manifest declaring an extra dependentAssembly pointing to attacker path with custom manifest.
4. Trigger printfilterpipelinesvc!SplPipeline::SplFilterPipelineCallObject::Begin_Print, reaching winspool!LoadNewCopy -> LoadLibraryExW of PrintConfig.dll.
5. OBJ_IGNORE_IMPERSONATED_DEVICEMAP loads legit DLL, but CSRSS builds activation context under impersonation and reads attacker SxS manifests.
6. Custom manifest loads attacker DLL at SYSTEM integrity.
**How found:** Same bug class as CVE-2022-29104 (patched May 2022) whose POC appeared on VirusTotal July 2022; likely variant analysis from that POC and the long-known 2015 DosDevices impersonation issue.
**Exploitation:** Attacker with local user access remaps C: via symlink, plants malicious SxS manifest, then triggers print pipeline service to load PrintConfig.dll; CSRSS activation context resolution follows the remapped drive and loads attacker DLL as SYSTEM, yielding LPE.
**Escalation:** LPE chained after initial RCE; used as privilege escalation stage in an exploit chain.
**Insight:** When a privileged process impersonates a user, any path resolution not covered by OBJ_IGNORE_IMPERSONATED_DEVICEMAP (here CSRSS SxS manifest lookup) follows the user's DOS device map; hunt for privileged components that resolve paths under impersonation and check whether each file open sets the ignore-device-map flag.