CISA orders federal agencies to fix actively exploited CVE-2022-21882 Windows flaw

US CISA ordered federal agencies to patch their systems against actively exploited CVE-2022-21882  Windows flaw.

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to address their systems against an actively exploited Windows vulnerability tracked as CVE-2022-21882.

“CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below.” reads the CISA’s announcement. “These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise.”

At the end of January, the security researchers RyeLv has publicly released an exploit for a Windows local privilege elevation flaw (CVE-2022-21882) that allows anyone to gain admin privileges in Windows 10. The Win32k elevation of privilege vulnerability was fixed in January as part of the January 2022 Patch Tuesday, it is the result of a bypass for the previously CVE-2021-1732 flaw.

“A local, authenticated attacker could gain elevated local system or administrator privileges through a vulnerability in the Win32k.sys driver.” reads the advisory published by Microsoft.

RyeLv also published a detailed analysis of the vulnerability that affects all supported support versions of Windows 10. Using this vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network, create new administrative users, or perform privileged commands.

CISA is ordering, in compliance with the binding operational directive (BOD 22-01), Federal Civilian Executive Branch Agencies (FCEB) agencies to patch all systems against the CVE-2022-21882 flaw within two weeks, until February 18th.

As usual, the US agency recommends private and public sector organizations to address the vulnerabilities included in the ‘Known Exploited Vulnerabilities Catalog‘ which is a list of known vulnerabilities that threat actors have abused in attacks and that are required to be addressed by Federal Civilian Executive Branch (FCEB).

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Windoes)