CVE-2023-36424
9.5 CISA KEVMicrosoft · Windows
A critical elevation of privilege vulnerability in the Windows Common Log File System (CLFS) driver allows local authenticated attackers to gain SYSTEM-level access via an out-of-bounds read.
Executive summary
This critical vulnerability in the Windows CLFS driver is actively exploited in the wild to grant attackers unauthorized SYSTEM-level privileges.
Vulnerability
This is an elevation of privilege vulnerability in the Windows Common Log File System (CLFS) driver, specifically involving an out-of-bounds read (CWE-125). A local attacker with low-level privileges can leverage this flaw to disclose kernel memory or corrupt kernel state, ultimately achieving SYSTEM-level execution.
Business impact
The potential impact of this vulnerability is severe, as it allows a low-privileged user to escalate to full system control. With a CVSS score of 9.5, this flaw poses a critical risk to organizational data integrity, confidentiality, and overall system security. Successful exploitation could lead to total system compromise, unauthorized data access, and the potential for lateral movement within the network.
Remediation
Immediate Action: Apply the November 2023 cumulative updates provided by Microsoft to all affected systems immediately. Refer to the official Microsoft Security Response Center advisory to identify the specific KB numbers corresponding to your Windows environment.
Proactive Monitoring: Monitor system logs for unusual kernel-mode crashes, unexpected CLFS driver activity, or unauthorized attempts to access sensitive system processes.
Compensating Controls: Ensure that Endpoint Detection and Response (EDR) solutions are active and configured to detect anomalous privilege escalation attempts on local workstations and servers.
Exploitation status
Public Exploit Available: Yes, a public Proof-of-Concept is available via GitHub (Nassim-Asrir/CVE-2023-36424).
Analyst recommendation
Due to the critical nature of this vulnerability, the confirmed active exploitation, and the presence of public exploit code, immediate patching is mandatory. Organizations must prioritize the deployment of the November 2023 cumulative updates across all identified Windows platforms to neutralize the risk of SYSTEM-level compromise. Failure to act promptly significantly increases the likelihood of a successful targeted attack on your infrastructure.