Very High
CVE-2022-21836
CVE-2022-21836
Add Assessment
Technical Analysis
This appears to be a vulnerability in the Windows Platform Binary Table verification, also known as WPBT verification for short. It appears this was originally discovered back in September 2021 by Mickey Shkatov and the researchers of Eclypsium, who published a paper on this titled Everyone Gets a Rootkit where they detailed this bug in greater detail.
Simply put, WPBT was introduced in Windows 8 that is an extension to an earlier protocol known as ACPI, or Advanced Configuration and Power Interface, which was originally designed to efficiently manage energy consumption in PCs. A flaw was found in WPBT verification whereby expired or compromised signatures could still be used to sign a WPBT binary, as these drivers were not in the kernel driver block list, which is stored as a file named driver.stl.
By signing a WPBT binary of the attackers creation with one of these expired or compromised certificates, authenticated attackers could get malicious code to load with kernel privileges when the target device boots up.
WPBT binaries are particularly powerful as they allow OEMS to modify the host operating system during boot. This is often needed to supply vendor-specific drivers, applications and content. As a result, compromising the integrity of this stage of the Windows OS loading process means that an attacker can install a rootkit onto the target system to easily maintain stealthy and persistent access to the target machine.
Its also important to note that this attack works even with Secured-core PCs running with the latest boot protections and mitigations. Therefore this vulnerability fundamentally this undercuts a lot of the new mitigations that were introduced with Windows 10 and Windows 11 to try prevent supply chain compromise and rootkit installation, which is a serious compromise of trust..
Overall I have rated this vulnerability as high on attacker value since this is essentially the highest form of privileges you can possibly get on a Windows OS, going beyond even SYSTEM level access to strike at the very heart of the OS itself, however the exploitability is somewhat lower as you would need to craft a valid WPBT binary, something that would take some time to research since I imagine not many people are familiar with how to do that. Signing it with a compromised/expired certificate though shouldn’t be that hard to do though :)
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- windows 10 -,
- windows 10 1607,
- windows 10 1809,
- windows 10 1909,
- windows 10 20h2,
- windows 10 21h1,
- windows 10 21h2,
- windows 11 -,
- windows 7 -,
- windows 8.1 -,
- windows server 2008 r2,
- windows server 2012 -,
- windows server 2012 r2,
- windows server 2016 -,
- windows server 2019 -,
- windows server 2022,
- windows server 20h2
