CVE-2023-36424 is a high-severity elevation of privilege vulnerability affecting the Windows Common Log File System (CLFS) driver (`clfs.sys`) [1].
Active Exploitation and Threat Actor Usage
- Status: The vulnerability is confirmed to be actively exploited in the wild.
- KEV Catalog: It is listed in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog.
- Threat Actors: While specific threat actor names are not always publicly attributed to every instance, reports indicate that ransomware groups and other cybercriminals have utilized this vulnerability in their campaigns.
Attack Method and Requirements
- Method: The vulnerability is an Out-of-Bounds (OOB) Read flaw triggered during the parsing of malformed Base Log Files (`.blf`).
- Requirements:
*
Access: It requires a local, authenticated attacker
[1].
*
Interaction: It is not a remote exploit; the attacker must already have low-privileged access to the target system to initiate the attack
[1].
Proof-of-Concept (PoC) Availability
- Technical analysis and working exploit code have been made publicly available by researchers and on platforms like GitHub.
Impact
- Successful exploitation allows a low-privileged local attacker to leak sensitive kernel pointers, bypass Kernel Address Space Layout Randomization (KASLR), and ultimately elevate their privileges to SYSTEM level. This grants the attacker full control over the affected host.
Affected Versions and Patch Status
- Affected Products: The vulnerability affects various versions of Microsoft Windows, including Windows 10, Windows 11, and Windows Server editions.
- Patch Status: Microsoft released security patches for this vulnerability in November 2023. Organizations are strongly urged to apply these updates immediately to mitigate the risk of compromise.