# CVE-2022-21972 — Windows PPTP `raspptp.sys` Remote Kernel Use-After-Free of the Control-Connection Context (`PptpCtlCtx`)

---

## Summary

| | |
|---|---|
| **Product** | Microsoft Windows — `raspptp.sys` (RAS PPTP VPN driver, RRAS server) |
| **CVE ID** | CVE-2022-21972 |
| **Impact** | Remote Code Execution — **pre-authentication**, kernel |
| **MSRC severity** | Critical |
| **CWE** | CWE-416: Use After Free (race condition, CWE-362) |
| **Patch Date** | May 10, 2022 |
| **Pre-patch binary** | `raspptp.sys` 10.0.19041.1586 (Mar 2022) — SHA256 `e2792fc0ea333c8d2afa3030bc344a3438f79d0520f5b0c8411f2c7e1863a2f5` |
| **Post-patch binary** | `raspptp.sys` 10.0.19041.1706 (May 10 2022 fix) — SHA256 `49106033d9b81a5c413d2f4e4547a0f2071a1e95b4d9226c6c7290c7163c01ff` |
| **Fix gating** | None — object-lifetime rework (rundown protection + refcount) |

---

## Product Description

`raspptp.sys` is the kernel driver implementing the **Point-to-Point Tunnelling
Protocol (PPTP)** side of Windows RRAS VPN. It listens on **TCP 1723** for the
PPTP **control connection** and uses GRE for data. When a client connects,
`WskAcceptCompletion` → `CtlConnectQueryCallback` completes setup and `CtlAlloc`
allocates the **control-connection context** `PptpCtlCtx` (0x290 bytes, pool tag
`TPTP`) that tracks the client's control-connection state. This object is the
subject of the bug. The control connection is reachable **pre-authentication**
from any host that can reach TCP 1723, so a memory-safety bug here is a remote
kernel RCE.

---

## Vulnerability Summary

Handling of PPTP control messages, the death/wait timeouts, and the receive
callback operate on the `PptpCtlCtx` concurrently, but its lifetime was not
safely reference-counted. A race between **freeing** the control-connection
context (cleanup / death timeout) and a concurrent **use** of it (an in-flight
received control packet, `CtlReceiveCallback` → `CtlpEngine`) lets one path free
`PptpCtlCtx` while another still dereferences it — a use-after-free on the 0x290
control-context allocation, reliably triggerable by crafted control traffic.

---

## Prerequisites and Constraints

- **Remote, unauthenticated** — anything that can open a PPTP control connection
  to TCP 1723 on an RRAS/PPTP server. No credentials.
- **Requires a race** (CWE-362) between the control-context teardown and a
  concurrent control-message/receive path; LRQA reports it reliably triggerable.
- Corruption is in kernel non-paged pool (the `TPTP`-tagged control context);
  DoS at minimum, kernel RCE/LPE with grooming.

---

## Vulnerability Details

### Root Cause

The `PptpCtlCtx` control-connection context is used across multiple concurrent
contexts — the PPTP control state machine (`CtlpEngine`), the receive callback
(`CtlReceiveCallback`), and the death/wait timers (`CtlpDeathTimeout`,
`CtlpWaitTimeout`) — while its teardown (`CtlpCleanup`) can run in parallel.
Without a robust reference count / rundown barrier gating the free, the object is
released while an in-flight user still holds it (CWE-416 via CWE-362).

### The patch (confirmed — diff, .1586 → .1706)

The May 2022 build reworks PPTP object lifetime to make frees safe against
concurrent use:

- **Rundown protection** is added to the control/call objects —
  `ExInitializeRundownProtection`, `ExAcquireRundownProtection` /
  `ExReleaseRundownProtection` around uses, and
  `ExWaitForRundownProtectionRelease` / `ExRundownCompleted` before free — so a
  free waits for all in-flight users to finish.
- New **`ReferenceRefCount` / `DereferenceRefCount`** helpers add explicit
  reference counting; `CtlAlloc`, `CtlpCleanup`, `CtlpEngine`,
  `CtlReceiveCallback`, `CtlpDeathTimeout` and related paths are updated to take a
  reference while using the context and to free only when the count/rundown
  says no user remains.

This removes the window in which `PptpCtlCtx` could be freed while still
referenced.

### Patch Completeness Assessment

Not a feature-gated fix — it is a structural object-lifetime rework (2022, before
the CFR-gating pattern). Patch state is determined by file version. The same
overhaul fixes the call-object UAF **CVE-2022-23270** in the same build.

---

## Detection Guidance

**Network.** Inbound PPTP control connections to **TCP 1723**, especially clients
that rapidly drive control-message sequences / teardowns designed to race the
control-context lifecycle. RRAS/PPTP should not be exposed to untrusted networks.

**Crash signature.** Kernel UAF/pool-corruption bugchecks in `raspptp!CtlpEngine`
/ `CtlReceiveCallback` / `CtlpCleanup` with the `TPTP` pool tag, on VPN servers.

**Exposure.** Inventory hosts running the RRAS PPTP role with TCP 1723 reachable;
prefer disabling PPTP (deprecated) or restricting 1723 to trusted networks.

---

## References

- LRQA / Nettitude — *CVE-2022-21972: Windows Server VPN Remote Kernel Use After
  Free Vulnerability* (Alex Nichols).
- MSRC advisory — CVE-2022-21972 (PPTP Remote Code Execution)
- Full binary diff: `/data/patch_diffs/raspptp_sys-cve-2022-21972-ghidriff.md`
- Sibling bug: CVE-2022-23270 (raspptp.sys call-object UAF/double-free, same build)