CVE-2022-35820: Windows 10 Bluetooth Privilege Escalation

CVE-2022-35820 Overview

CVE-2022-35820 is an elevation of privilege vulnerability in the Microsoft Windows Bluetooth driver. The flaw allows an authenticated local attacker to escalate privileges on an affected system. Microsoft published the advisory on August 9, 2022 as part of its monthly security update cycle.

The vulnerability affects a broad range of Windows client and server platforms, including Windows 7 through Windows 11 and Windows Server 2008 through Windows Server 2022. Successful exploitation results in high impact to confidentiality, integrity, and availability of the host.

Critical Impact
A local, low-privileged attacker can exploit the Windows Bluetooth driver to gain elevated privileges and achieve full control over the affected host.

Affected Products

Microsoft Windows 10, Windows 11, Windows 8.1, Windows RT 8.1, and Windows 7 SP1
Microsoft Windows Server 2008 R2 SP1, Server 2012, Server 2012 R2, Server 2016, Server 2019, and Server 2022
All architectures listed in Microsoft advisory (x86, x64, ARM64)

Discovery Timeline

2022-08-09 - CVE-2022-35820 published to NVD by Microsoft
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-35820

Vulnerability Analysis

CVE-2022-35820 is a driver vulnerability in the Windows Bluetooth stack that enables elevation of privilege. The issue resides in kernel-mode code, meaning successful exploitation grants the attacker SYSTEM-level privileges from a standard user context. Microsoft classifies the weakness under NVD-CWE-noinfo, and detailed root-cause information has not been disclosed publicly.

The attack vector is local, and the attacker must already hold valid low-privilege credentials on the target host. No user interaction is required to trigger the flaw. According to EPSS data, the vulnerability sits in the 77.95th percentile for exploit prediction, indicating a higher-than-average likelihood of weaponization relative to other CVEs.

Root Cause

The root cause involves improper handling of input or state inside the Windows Bluetooth driver, allowing a local process to manipulate kernel structures or operations it should not access. Microsoft has not published a detailed technical breakdown of the underlying defect. The advisory categorizes the issue as a driver-level elevation of privilege consistent with [CWE-noinfo].

Attack Vector

An attacker with local code execution and standard user privileges interacts with the vulnerable Bluetooth driver interface to trigger the flaw. Because the driver runs in kernel mode, abuse of the exposed interface lets the attacker run code in the kernel context. This path is typically used as a post-compromise step after initial access through phishing, malware, or stolen credentials.

No public proof-of-concept code or exploit module is currently published for CVE-2022-35820. Refer to the Microsoft Security Update Guide for vendor-confirmed details.

Detection Methods for CVE-2022-35820

Indicators of Compromise

Unexpected loading or interaction with Windows Bluetooth driver components such as bthport.sys, bthusb.sys, or related kernel modules from non-Bluetooth processes
Standard user processes spawning child processes running as NT AUTHORITY\SYSTEM without a legitimate elevation path
Crashes or unusual error events in the System event log referencing Bluetooth driver components

Detection Strategies

Monitor for unsigned or unusual code attempting to open handles to Bluetooth driver device objects from non-Bluetooth user-mode processes
Correlate token-elevation events (Event ID 4672, 4673, 4688) with parent processes lacking legitimate elevation rights
Apply behavioral analytics to flag local privilege escalation patterns originating from user sessions on workstations and servers

Monitoring Recommendations

Ingest Windows Security, System, and Sysmon logs into a centralized SIEM and alert on anomalous kernel driver interactions
Track patch compliance for the August 2022 cumulative updates across all Windows endpoints and servers
Audit which hosts have the Bluetooth service and driver enabled, and reduce exposure on systems that do not require Bluetooth

How to Mitigate CVE-2022-35820

Immediate Actions Required

Apply the August 2022 Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Windows versions
Prioritize patching on multi-user systems, jump hosts, and any endpoints where low-privileged users have local logon rights
Verify update installation status across the fleet using your patch management or configuration management tooling

Patch Information

Microsoft addressed CVE-2022-35820 in the August 9, 2022 Patch Tuesday release. Each affected operating system receives a dedicated cumulative update or monthly rollup. Identify the correct KB article for each Windows build from the Microsoft Security Update Guide and deploy through Windows Update, WSUS, Microsoft Intune, or your preferred patch distribution mechanism.

Workarounds

Disable the Windows Bluetooth Support Service (bthserv) on systems that do not require Bluetooth functionality, removing the attack surface
Restrict local logon rights to trusted administrative users only, reducing the population of accounts able to launch a local exploit
Enforce application allowlisting to prevent unauthorized binaries from executing and interacting with kernel driver interfaces

bash

# Configuration example: disable Bluetooth Support Service where not required
sc.exe config bthserv start= disabled
sc.exe stop bthserv