CVE-2023-29336
Published: 09 May 2023
Summary
CVE-2023-29336 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2023-29336 is a use-after-free vulnerability (CWE-416) in the Win32k component of the Windows kernel that carries a CVSS 3.1 score of 7.8. The flaw permits an authenticated local user to elevate privileges on affected Windows systems.
An attacker who already possesses a low-privileged local account can trigger the vulnerability without user interaction to obtain full administrative control over the host, resulting in complete compromise of confidentiality, integrity, and availability.
Microsoft’s security update guide provides patches that address the issue, and the vulnerability appears in CISA’s catalog of known exploited vulnerabilities. The associated EPSS score has remained elevated, with a current value of 0.7666 and a recorded peak of 0.7946. Public exploit code is also available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32910
Vulnerability details
Win32k Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 09 May 2023
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patch that eliminates the use-after-free flaw in Win32k.
Implements memory-protection safeguards that block exploitation of the kernel-mode use-after-free condition before privilege escalation occurs.
Enforces separate execution domains that limit the blast radius of a Win32k flaw escaping from user-mode graphics operations into SYSTEM-level kernel code.