CVE-2022-21877: Microsoft Windows Storage Spaces Out-Of-Bounds Read Information Disclosure Vulnerability
Storage Spaces Controller Information Disclosure Vulnerability
Other sources
This vulnerability allows local attackers to disclose sensitive information on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the spaceport.sys driver. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated array. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of SYSTEM.
— ZDI
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-21877?
CVE-2022-21877 is a vulnerability in Microsoft Windows that allows local attackers to disclose sensitive information.
What is the severity of CVE-2022-21877?
CVE-2022-21877 has a severity rating of high with a score of 5.6.
How can an attacker exploit CVE-2022-21877?
To exploit CVE-2022-21877, an attacker must first obtain the ability to execute low-privileged code on the target system.
Which versions of Microsoft Windows are affected by CVE-2022-21877?
Microsoft Windows 10 (20H2, 21H1), Windows 11, and Windows Server (20H2, 2022) are affected by CVE-2022-21877.
How can I fix CVE-2022-21877?
To fix CVE-2022-21877, you should apply the available patches provided by Microsoft.