CVE-2021-1732Disclosure(microsoft / windows_10_1803)

CVE-2021-1732 is a great example of how a tiny logic bug can compromise the entire Windows kernel. During "NtUserCreateWindowEx()", an attacker abuses a user-mode callback to confuse "win32k.sys" about a window's "cbWndExtra" and "pExtraBytes" fields. This type confusion turns "SetWindowLongPtr()" into an arbitrary kernel read/write primitive, allowing the attacker to overwrite the current process token with the SYSTEM token and gain full privileges. https://safe.security/wp-content/uploads/windows-win32k-elevation-of-privilege-vulnerability.pdf

CVE-2021-28310 is a Windows privilege escalation vulnerability in the Desktop Window Manager (DWM) that was exploited in the wild. The root cause is an out-of-bounds write in "dwmcore.dll". By abusing the DirectComposition API, an attacker can write controlled data to a controlled kernel offset due to missing bounds checks. Kaspersky found the exploit while analyzing a separate in-the-wild zero-day (CVE-2021-1732), highlighting how one exploit investigation can uncover another. Beyond the vulnerability itself, the research is worth reading for its deep dive into DirectComposition, DWM internals, and the "NtDComposition*" system calls used to communicate with the kernel.