OnlyPatch
Windows Cluster Port Driver

CVE-2022-21910 — Microsoft Cluster Port Driver Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.00599 🔬 Patch diffed 2022-01 archive

Executive Summary

None

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Released Jan 11 2022
Last Updated Jan 11 2022
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00599 — 0.45693 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.00599
probability of exploitation in the next 30 days
0.45693 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

7 affected products
Product KB Article Severity Impact Restart Required
Windows Server 2016 5009546 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5009546 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5009557 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5009557 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5009555 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5009555 (Security Update) Important Elevation of Privilege Yes
Windows Server, version 20H2 (Server Core Installation) 5009543 (Security Update) Important Elevation of Privilege Yes

Patches

4 patches
Article Type Restart
5009546 Security Update Yes
5009557 Security Update Yes
5009555 Security Update Yes
5009543 Security Update Yes

Patch Diff

ghidriff · clusport.sys (KB5009557)

Multiple input-validation flaws (CWE-476 NULL pointer dereference / CWE-125 out-of-bounds read) in the Microsoft Cluster Port driver clusport.sys, reachable via the low-privilege-openable \Device\CLUSPORT link -> local kernel DoS (and MSRC-rated EoP). The driver fails to validate fields of the user input buffer (fault-domain / network-target / path add IOCTLs) before dereferencing/indexing, so crafted input triggers a NULL deref or reads past the buffer, bugchecking the kernel. IN-HOUSE ghidriff of clusport.sys 10.0.17763.1192 -> .2452 (Jan 11 2022) confirms the fix: new validation functions ClusPortValidateFaultDomain and ClusPortValidateNetworkTarget are added and called from ClusPortAddNetworkPath / ClusPortSetFDInfo, and size arithmetic is hardened with RtlULongAdd (checked add) - validating the input buffer before use.

Pre-patch version 10.0.17763.1192 Download
Post-patch version 10.0.17763.2452 Download
Function Address Change Note
ClusPortValidateFaultDomain added added (input validation) New validator for the fault-domain input structure, called before the data is used.
ClusPortValidateNetworkTarget added added (input validation) New validator for the network-target input, added by the fix.
ClusPortAddNetworkPath / ClusPortSetFDInfo code change code (call validators + checked add) IOCTL handlers reworked to call the new validators and use RtlULongAdd (checked) for size arithmetic before dereferencing/indexing the user buffer - closing the NULL deref / OOB read.
View full diff report View RCA report

Attack Path

Unvalidated CLUSPORT IOCTL input is dereferenced/indexed, bugchecking the kernel

Attack path for CVE-2022-21910 Unvalidated CLUSPORT IOCTL input is dereferenced/indexed, bugchecking the kernel 01 — ENTRY Low-privileged process opens \Device\CLUSPORT and issues an IOCTL clusport.sys (Microsoft Cluster Port) creates a CLUSPORT device link openable/writable by low-privileged processes. 02 — CONTROLLED INPUT Sends a crafted input buffer for a fault-domain / network-target / add-path request Fields in the buffer (counts, offsets, pointers) are attacker-controlled. 03 — PATH The driver uses those fields to dereference/index without validation Handlers like ClusPortAddNetworkPath / ClusPortSetFDInfo consume the fields directly. 04 — MISSING CHECK Missing input validation of the buffer fields A crafted field yields a NULL pointer dereference (CWE-476) or a read past the buffer (CWE-125). 05 — PRIMITIVE Kernel crash (DoS) from a low-privileged caller The bad deref/read bugchecks the kernel. The Jan 2022 fix adds ClusPortValidateFaultDomain/ValidateNetworkTarget and checked (RtlULongAdd) arithmetic before use.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

JIWO Technology Co., Ltd

On This Page