OnlyPatch
XBox

CVE-2022-21967 — Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability

Important CVSS 7 EPSS 0.00681 🔬 Patch diffed 2022-03 archive

Executive Summary

None

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Released Mar 8 2022
Last Updated Mar 8 2022
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00681 — 0.49302 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.00681
probability of exploitation in the next 30 days
0.49302 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

21 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 5011491 (Security Update) Important Elevation of Privilege Yes
Windows 10 for x64-based Systems 5011491 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for 32-bit Systems 5011495 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5011495 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5011503 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for ARM64-based Systems 5011503 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5011503 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1909 for 32-bit Systems 5011485 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1909 for ARM64-based Systems 5011485 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1909 for x64-based Systems 5011485 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 20H2 for 32-bit Systems 5011487 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 20H2 for ARM64-based Systems 5011487 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 20H2 for x64-based Systems 5011487 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H1 for 32-bit Systems 5011487 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H1 for ARM64-based Systems 5011487 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H1 for x64-based Systems 5011487 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5011487 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5011487 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5011487 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for ARM64-based Systems 5011493 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for x64-based Systems 5011493 (Security Update) Important Elevation of Privilege Yes

Patches

6 patches
Article Type Restart
5011491 Security Update Yes
5011495 Security Update Yes
5011503 Security Update Yes
5011485 Security Update Yes
5011487 Security Update Yes
5011493 Security Update Yes

Patch Diff

ghidriff · XblAuthManagerProxy.dll (KB5011487)

Integer overflow -> out-of-bounds write (CWE-190) in XblAuthManagerProxy.dll (Xbox Live Auth Manager), the custom COM marshaling proxy for Xbox Live auth tokens. ReadStringFromStream reads a client-supplied element count from a marshaled stream and computes the byte size as count*2 (WCHAR) without bounding count, so a large count overflows the size used for allocation/copy -> OOB write in the receiving (higher-privileged) process. IN-HOUSE ghidriff of XblAuthManagerProxy.dll 10.0.19041.746 -> .1586 (Mar 8 2022) confirms the fix: ReadStringFromStream now checks the length is < 0x100001 (bounded to <= 0x100000) before computing cb = count*2, and verifies the actually-read byte count equals cb (else returns 0x8000ffff/-0x7fff0001) - preventing the overflow.

Pre-patch version 10.0.19041.746 Download
Post-patch version 10.0.19041.1586 Download
Function Address Change Note
ReadStringFromStream code change code (length bound before *2 added) Pre: reads a count and computes cb = count*2 for a WCHAR string from the marshaled stream without an upper bound -> integer overflow of the size. Post: `if (len < 0x100001)` guard (<= 0x100000) before `cb = len*2`, plus a check that the read byte count == cb, else error - eliminating the overflow/OOB write.
View full diff report View RCA report

Attack Path

A marshaled string element count is doubled to bytes without a bound, overflowing the size for an OOB write

Attack path for CVE-2022-21967 A marshaled string element count is doubled to bytes without a bound, overflowing the size for an OOB write 01 — ENTRY A process sends a marshaled Xbox Live auth object across the XblAuthManagerProxy COM boundary XblAuthManagerProxy.dll implements custom COM marshaling proxies so processes exchange auth data; the receiving side unmarshals attacker-influenced data. 02 — CONTROLLED INPUT Supplies a large string element count in the marshaled stream ReadStringFromStream reads the count that precedes the string bytes. 03 — PATH It computes the byte size as count*2 (WCHAR) and allocates/copies The doubled value is used as the buffer size for the string read. 04 — MISSING CHECK count is not bounded before the *2, so the size integer overflows A count near/over 0x80000000 wraps when doubled, yielding a small allocation for a large copy (CWE-190). 05 — PRIMITIVE Heap out-of-bounds write in the unmarshaling process -> EoP The size/copy desync overruns the buffer with marshaled bytes. The Mar 2022 fix bounds the count (< 0x100001) before doubling and verifies the read length.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Rick Veldhoven

On This Page