# CVE-2022-21910 — Microsoft Cluster Port `clusport.sys` Kernel DoS via Unvalidated IOCTL Input

## Summary
| | |
|---|---|
| **Product** | Windows — `clusport.sys` (Microsoft Cluster Port driver) |
| **CVE ID** | CVE-2022-21910 |
| **Impact** | Elevation of Privilege |
| **CWE** | CWE-476: NULL Pointer Dereference / CWE-125: Out-of-bounds Read |
| **Patch Date** | January 11, 2022 |
| **Pre-patch** | `clusport.sys` 10.0.17763.1192 |
| **Post-patch** | `clusport.sys` 10.0.17763.2452 |
| **Fix gating** | None — input validators added |

## Vulnerability
`clusport.sys` creates the `\Device\CLUSPORT` link, **openable and writable by low-privileged processes**. Several IOCTL handlers (fault-domain / network-target / add-path) consume fields of the user input buffer — counts, offsets, pointers — and dereference/index them **without validation**, so crafted input triggers a **NULL pointer dereference** (CWE-476) or a **read past the buffer** (CWE-125), bugchecking the kernel (DoS).

## The patch (confirmed — diff)
New validators **`ClusPortValidateFaultDomain`** and **`ClusPortValidateNetworkTarget`** are added and called from **`ClusPortAddNetworkPath`** / **`ClusPortSetFDInfo`**, and size arithmetic is hardened with **`RtlULongAdd`** (checked add) — validating the input buffer before use. Unconditional (2022).

## Detection
Low-privileged processes opening `\Device\CLUSPORT` and issuing malformed cluster IOCTLs; bugchecks in `clusport!ClusPortAddNetworkPath` / `ClusPortSetFDInfo`.

## References
- CVE-2022-21910 · MSRC advisory · Full diff: `/data/patch_diffs/clusport_sys-cve-2022-21910-ghidriff.md`