Windows Credential Guard ASN1 Decoder Type Confusion Privilege Escalation

On Windows, a number of Kerberos CG APIs do not verify the ASN1 PDU type when decoding and encoding Kerberos ASN1 structures leading to type confusion and elevation of privilege.

credential decoder escalation guard privilege privilege escalation type confusion windows