Attacker Value
Very High
CVE-2022-21906
Attacker Value
Very High
(1 user assessed)
Exploitability
Very High
(1 user assessed)User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
CVE-2022-21906
(Last updated November 28, 2024) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Execution
Techniques
Validation
Description
Windows Defender Application Control Security Feature Bypass Vulnerability
Add Assessment
1
Technical Analysis
CVE-2022-21906
Microsoft
Vendor
Description
Windows Defender Application Control Security Feature Bypass Vulnerability.
The attacker can execute extremely dangerous apps by using different scenarios,
directly from the user profile, without any reaction from the side of the Windows Defender.
Read more: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21906
The latest version of Windows 10 Pro, plus the latest update!
Reproduce:
Proof and Exploit
BugCheck after the exploit, the reaction of the kernel:
BSOD.exe
1: kd> !analyze ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Unknown bugcheck code (c0000022) Unknown bugcheck description Arguments: Arg1: 0000000000000000 Arg2: 0000000000000000 Arg3: 0000000000000000 Arg4: 0000000000000000 Debugging Details: ------------------ ERROR_CODE: (NTSTATUS) 0xc0000022 - {Access Denied} A process has requested access to an object, but has not been granted those access rights. BUGCHECK_CODE: c0000022 BUGCHECK_P1: 0 BUGCHECK_P2: 0 BUGCHECK_P3: 0 BUGCHECK_P4: 0 PROCESS_NAME: BSOD.exe SYMBOL_NAME: nt!PopTransitionSystemPowerStateEx+1217 MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe FAILURE_BUCKET_ID: STATUS_ACCESS_DENIED_nt!PopTransitionSystemPowerStateEx FAILURE_ID_HASH: {7fcb0a96-b639-2e09-82d6-2eef48bdcdea} Followup: MachineOwner ---------
malicious.exe
0: kd> !analyze ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Unknown bugcheck code (c0000022) Unknown bugcheck description Arguments: Arg1: 0000000000000000 Arg2: 0000000000000000 Arg3: 0000000000000000 Arg4: 0000000000000000 Debugging Details: ------------------ ERROR_CODE: (NTSTATUS) 0xc0000022 - {Access Denied} A process has requested access to an object, but has not been granted those access rights. BUGCHECK_CODE: c0000022 BUGCHECK_P1: 0 BUGCHECK_P2: 0 BUGCHECK_P3: 0 BUGCHECK_P4: 0 PROCESS_NAME: malicious.exe SYMBOL_NAME: nt!PopTransitionSystemPowerStateEx+1217 MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe FAILURE_BUCKET_ID: STATUS_ACCESS_DENIED_nt!PopTransitionSystemPowerStateEx FAILURE_ID_HASH: {7fcb0a96-b639-2e09-82d6-2eef48bdcdea} Followup: MachineOwner ---------
BR
nu11secur1ty
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
None
Impact Score:
Unknown
Exploitability Score:
Unknown
Attack Vector (AV):
Unknown
Attack Complexity (AC):
Unknown
Privileges Required (PR):
Unknown
User Interaction (UI):
Unknown
Scope (S):
Unknown
Confidentiality (C):
Unknown
Integrity (I):
Unknown
Availability (A):
Unknown
General Information
Vendors
- microsoft
Products
- windows 10 1809,
- windows 10 1909,
- windows 10 20h2,
- windows 10 21h1,
- windows 10 21h2,
- windows 11 -,
- windows server 2019 -,
- windows server 2022,
- windows server 20h2
References
Miscellaneous
