Public proof-of-concept released for patched Windows WinSock privilege escalation flaw CVE-2023-21768
- Severity
- High
- Exploited
- Yes
- Sources
- 1
What happened
CVE-2023-21768 is a CVSS 7.8 local privilege escalation in afd.sys (Ancillary Function Driver for WinSock), fixed in January 2023 by adding validation of user-mode pointers in AfdNotifyRemoveIoCompletion. A public GitHub proof-of-concept by Valentina Palmiotti (chompie) and Ruben Boonen chains an arbitrary kernel write into kernel read/write via I/O ring objects and replaces a process token with a SYSTEM token; the full chain is stated to work on Windows 11 22H2, and the demo reportedly bypassed HVCI. IBM reports a separate in-the-wild sample from 360 IceSword Lab in January 2023 using ProcessSocketNotifications, and states it does not establish the published code was used by attackers. Defenders should confirm that Microsoft's January 2023 fix, or later cumulative updates, is installed on all affected Windows systems, and should not rely on HVCI as a substitute for patching.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Verify that all affected Windows devices have received Microsoft's January 2023 fix for CVE-2023-21768 or a later applicable update.
- Do not treat HVCI as a replacement for applying the patch.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 3 updates
Who reported · 1 outlet
Who and what is in it
Products