A recently released proof-of-concept exploit for CVE-2023-21768 illustrates how attackers with local access can escalate their privileges to SYSTEM level via the Windows Ancillary Function Driver for WinSock.
Details of the Exploit
This exploit was developed and released by security researchers Valentina Palmiotti, also known as chompie, and Ruben Boonen. Their code specifically targets Windows 11 22H2 systems that are vulnerable to this flaw.
The exploit concerns a vulnerability that was patched in January 2023, not a newly identified flaw in Windows. IBM shared a detailed technical analysis of this vulnerability on March 21, 2023.
Technical Analysis of the Vulnerability
The CVE-2023-21768 vulnerability is rated with a CVSS score of 7.8, reflecting its seriousness. It requires low-level local privileges to be exploited and does not enable direct attacks over the internet. The flaw resides in afd.sys, a Windows kernel driver that processes requests from the WinSock networking interface.
According to IBM’s analysis, the researchers compared driver versions from December 2022 and January 2023 to identify Microsoft’s patch. They found changes in the AfdNotifyRemoveIoCompletion function, which helped them pinpoint the issue.
The flaw originated from the older code’s failure to validate a memory pointer from a user application, allowing a local attacker to write to kernel memory where sensitive system data is stored.
Implications and Recommendations
The researchers demonstrated how quickly an exploit can be developed by analyzing differences between patched and unpatched software. Their public GitHub repository includes the code, described as a demonstration of a complete privilege escalation chain on vulnerable Windows 11 22H2 installations.
Administrators are advised to ensure affected systems have received Microsoft’s patch or any subsequent updates. IBM’s demonstration also indicated that the exploit was not blocked by Hypervisor-protected Code Integrity (HVCI), underscoring the importance of applying patches.
Additional related security issues include CVE-2024-38193 and the CVE-2025-32709 WinSock zero-day, which involve similar drivers but are separate flaws requiring different patches.
