CVE-2022-22047: Windows CSRSS Privilege Escalation Flaw

CVE-2022-22047 Overview

CVE-2022-22047 is an elevation of privilege vulnerability affecting the Windows Client Server Run-time Subsystem (CSRSS), a critical Windows system process responsible for console windows, thread creation and deletion, and other essential system functions. This vulnerability allows an authenticated attacker with local access to elevate their privileges to SYSTEM level, granting complete control over the affected Windows system.

Critical Impact

This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Successful exploitation grants SYSTEM-level privileges, enabling attackers to install programs, view/change/delete data, and create new accounts with full user rights.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 20H2, 21H1, 21H2)
• Microsoft Windows 11 21H2
• Microsoft Windows 7 SP1
• Microsoft Windows 8.1 and Windows RT 8.1
• Microsoft Windows Server 2008 SP2 and R2 SP1
• Microsoft Windows Server 2012 and 2012 R2
• Microsoft Windows Server 2016, 2019, 2022, and 20H2

Discovery Timeline

• July 12, 2022 - CVE-2022-22047 published to NVD
• October 30, 2025 - Last updated in NVD database

Technical Details for CVE-2022-22047

Vulnerability Analysis

This elevation of privilege vulnerability exists within the Windows Client Server Run-time Subsystem (csrss.exe), which is a fundamental Windows process that runs in user mode and handles critical system operations. The vulnerability is classified under CWE-426 (Untrusted Search Path), indicating that the flaw stems from how CSRSS handles DLL loading or resource searching operations.

The vulnerability requires local access and low-privilege authentication, but does not require user interaction to exploit. Once exploited, an attacker can achieve complete compromise of confidentiality, integrity, and availability on the target system. The unchanged scope means the vulnerability impacts only the vulnerable component itself, though SYSTEM-level access effectively grants control over the entire operating system.

Root Cause

The root cause is attributed to CWE-426: Untrusted Search Path. This weakness occurs when the CSRSS process searches for resources (such as DLLs) in directories that may be under the control of a malicious actor. By placing a specially crafted file in a location that CSRSS searches before the legitimate resource location, an attacker can cause the system process to load malicious code with elevated privileges.

Attack Vector

The attack vector is local, requiring an attacker to first gain access to the target system with a low-privileged user account. From there, the attacker can exploit the untrusted search path vulnerability in CSRSS to escalate their privileges to SYSTEM level. This makes the vulnerability particularly dangerous in post-compromise scenarios, where attackers who have gained initial access through phishing or other means can quickly elevate to full system control.

The exploitation technique typically involves:

1. Gaining initial low-privilege access to a Windows system
2. Placing a malicious DLL or resource in a directory searched by CSRSS
3. Triggering CSRSS to load the malicious resource
4. Executing code in the context of the SYSTEM account

Detection Methods for CVE-2022-22047

Indicators of Compromise

• Unusual DLL files appearing in directories within the system search path, particularly in user-writable locations
• Unexpected child processes spawned by csrss.exe or abnormal behavior from the CSRSS process
• Privilege escalation events in Windows Security logs showing users suddenly gaining SYSTEM-level access
• Process creation events with unusual parent-child relationships involving CSRSS

Detection Strategies

• Monitor for DLL loading anomalies in csrss.exe using endpoint detection and response (EDR) solutions such as SentinelOne Singularity
• Implement Windows Event Log monitoring for Event ID 4688 (process creation) and correlate with privilege escalation indicators
• Deploy file integrity monitoring on system directories to detect unauthorized file placement
• Use behavioral analysis to identify suspicious privilege escalation patterns

Monitoring Recommendations

• Enable detailed process tracking and command-line logging through Group Policy
• Configure SentinelOne Singularity agents to alert on CSRSS behavioral anomalies and privilege escalation attempts
• Establish baselines for normal CSRSS behavior and alert on deviations
• Monitor for exploitation attempts using CISA's recommended detection guidance

How to Mitigate CVE-2022-22047

Immediate Actions Required

• Apply the Microsoft July 2022 security updates immediately to all affected Windows systems
• Prioritize patching systems that are internet-facing or accessible to untrusted users
• Review systems for signs of compromise, as this vulnerability has been actively exploited in the wild
• Ensure SentinelOne Singularity agents are deployed and updated to detect exploitation attempts

Patch Information

Microsoft addressed this vulnerability in the July 2022 Patch Tuesday security updates. Organizations should apply the appropriate security update for their Windows version as outlined in the Microsoft Security Update Guide. Given the active exploitation status and inclusion in the CISA Known Exploited Vulnerabilities Catalog, federal agencies were required to remediate this vulnerability according to CISA's specified timeline.

Workarounds

• Implement the principle of least privilege to limit the impact of successful exploitation
• Restrict local logon rights to minimize the attack surface for local privilege escalation vulnerabilities
• Use application control solutions to prevent unauthorized executables and DLLs from running
• Segment networks to limit lateral movement if systems cannot be immediately patched

# Verify patch installation status
wmic qfe list | findstr /i "KB5015807"

# Check Windows version and build number
systeminfo | findstr /i "OS Version"