Windows WinSock AFD CVE-2023-21768: public PoC released, report says

What happened

According to Cyber Security News, researchers Valentina Palmiotti (chompie) and Ruben Boonen have published proof-of-concept exploit code for CVE-2023-21768. This is a local privilege escalation flaw in afd.sys, the Windows Ancillary Function Driver for WinSock. The outlet says this is not a new flaw. Microsoft patched it in January 2023, and IBM published the researchers’ technical analysis on March 21, 2023. This advisory relies on a single news report. No official Microsoft or NVD record was included in the source material.

Cyber Security News reports the following details:

• The flaw carries a CVSS score of 7.8.
• An attacker needs low-level local privileges and no user interaction is required.
• The flaw does not provide a direct route into a computer over the internet.
• The vulnerable code did not validate a memory pointer supplied from user mode. This let a local attacker write to kernel memory.
• Microsoft’s fix added validation so that user-mode pointers must reference user-space memory.

Citing IBM’s analysis, the outlet says the researchers found the fix by comparing driver versions from December 2022 and January 2023. Only the function AfdNotifyRemoveIoCompletion appeared to have changed.

The outlet says the GitHub repository describes the code as a demonstration. The full privilege escalation chain works on vulnerable Windows 11 22H2 systems. The underlying memory-write capability works across vulnerable systems, but the repository does not promise full compatibility with every affected Windows version.

According to the report, the exploit works in these steps:

1. It manipulates Windows I/O ring objects, building on research by Yarden Shafir.
2. This gives it kernel memory read and write.
3. It then replaces a target process’s security token with one carrying SYSTEM privileges.

Cyber Security News also reports, citing IBM, that 360 IceSword Lab found a different exploit in the wild in January 2023, which used the ProcessSocketNotifications interface. The outlet states its report does not establish that attackers used the published GitHub code.

Am I affected?

• You may be affected if you run Windows systems that have not received Microsoft’s January 2023 fix or later applicable updates, according to Cyber Security News.
• The outlet says the complete public exploit chain targets vulnerable Windows 11 22H2 installations. The full list of affected Windows versions is not confirmed in the source.
• An attacker would need local access with low privileges. The outlet says the flaw is not directly reachable over the internet.
• The outlet says IBM’s demonstration was not blocked by HVCI, so having HVCI enabled does not mean you are protected.

What to do now

1. Check that affected Windows devices have Microsoft’s January 2023 fix for CVE-2023-21768 or later applicable updates, as Cyber Security News recommends.
2. Give priority to unpatched Windows 11 22H2 systems, since the public exploit chain targets them, per the same report.
3. Do not treat HVCI as a substitute for patching. The report says IBM’s demonstration worked without being blocked by it.

Sources

• Cyber Security News: POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability