# CVE-2022-35820 — Windows Bluetooth `bthport.sys` Registry-Symlink EoP in the HCI Local-Service-Key Path

## Summary
| | |
|---|---|
| **Product** | Windows — `bthport.sys` (Bluetooth core driver) |
| **CVE ID** | CVE-2022-35820 |
| **Impact** | Elevation of Privilege |
| **CWE** | CWE-285: Improper Authorization |
| **Patch Date** | August 9, 2022 |
| **Pre-patch** | `bthport.sys` 10.0.19041.1682 |
| **Post-patch** | `bthport.sys` 10.0.19041.1889 |
| **Fix gating** | None — new access-checked create helper |

## Vulnerability
When a Bluetooth adapter is present, `bthport.sys` exposes a device link openable by low-privileged processes. Issuing IOCTL `0x41104C` calls `HCI_SetLocalServiceInfo` → `HCI_GetLocalServiceKey`, which creates registry keys (local service info) with `ZwCreateKey` **without `OBJ_FORCE_ACCESS_CHECK`**. The create runs with the driver's SYSTEM authority and does not evaluate the caller, so a user who can create the target subkey plants a **registry symbolic link** and forces the SYSTEM driver to create/modify **arbitrary `HKLM` keys** — EoP (CWE-285).

## The patch (confirmed — diff)
A new helper **`BthCreateKeyEx`** (access-checked registry create) and **`Microsoft::Bluetooth::BthCoreCx::Driver::UpdateRegistryKeysSecurity`** are added, and the HCI registry-update paths (`HCI_RegUpdate*`, the local-service-key path) are reworked to use them — so key creation is access-checked and does not follow user-planted symlinks. Unconditional (2022).

## Detection
Low-privileged processes issuing Bluetooth IOCTL `0x41104C`; registry symlinks under the Bluetooth service-key area; SYSTEM writes to unexpected `HKLM` keys attributable to `bthport`.

## References
- CVE-2022-35820 · MSRC advisory · Full diff: `/data/patch_diffs/bthport_sys-cve-2022-35820-ghidriff.md`