HighZero-Day
POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability
Cyber Security News·Source published ·1 min read
What happened?
A public proof-of-concept exploit for CVE-2023-21768 shows how attackers with local access can gain SYSTEM privileges through the Windows Ancillary Function Driver for WinSock. Researchers Valentina Palmiotti, known as chompie, and Ruben Boonen published the code. Their complete exploit targets vulnerable Windows 11 22H2 systems. The release concerns a vulnerability patched in January 2023, not a newly disclosed Windows flaw. IBM published the researchers’ technical analysis on March 21, 2023.
Key details
- A public proof-of-concept exploit for CVE-2023-21768 demonstrates local privilege escalation to SYSTEM via the Windows Ancillary Function Driver for WinSock.
- Researchers Valentina Palmiotti and Ruben Boonen published the exploit code targeting vulnerable Windows 11 22H2 systems.
- Microsoft's fix added validation to ensure user-mode pointers reference user-space memory instead of protected kernel addresses.
Affected
- Windows 11 22H2 systems without the January 2023 patch are affected.
- The underlying memory-write capability works across other vulnerable Windows versions.
What to look for
- Exploitation involves manipulation of Windows I/O ring objects for kernel memory read/write operations.
- A different in-the-wild exploit sample from January 2023 used the ProcessSocketNotifications interface.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.