CVE-2011-2005
Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability
Description
CVE-2011-2005 is a privilege escalation vulnerability in the Ancillary Function Driver (afd.sys) in Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2. The flaw allows a local authenticated attacker to elevate privileges to SYSTEM level by exploiting improper validation of user-supplied input in the AFD driver. With an EPSS score of 0.1% (49.3rd percentile), this vulnerability has seen targeted exploitation. CISA has added CVE-2011-2005 to the Known Exploited Vulnerabilities catalog, confirming real-world exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows server 2003 | - |
| microsoft | windows xp | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-080(Patch, Vendor Advisory)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13114(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-2005(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
CVE-2011-2005 is a privilege escalation vulnerability caused by improper privilege management in the Windows Ancillary Function Driver (afd.sys). The kernel-mode driver fails to properly validate user-mode input, allowing a local attacker to manipulate driver operations and execute code with elevated SYSTEM-level privileges.
Learn more: CWE-269 — Improper Privilege Management
Impact Analysis
CVE-2011-2005 has a CVSS v2 base score of 7.2 (High), reflecting the significant impact of local privilege escalation to SYSTEM level. While the attack requires local access and an authenticated user account, successful exploitation grants the attacker the highest privileges on the system, enabling complete control including installing programs, modifying data, and creating accounts with full administrative rights. The EPSS score of 0.1% (49.3rd percentile) indicates targeted but less widespread exploitation compared to remote vulnerabilities. However, privilege escalation vulnerabilities are critical components in attack chains, often used after initial access to achieve full system compromise.
Exploit Maturity
CVE-2011-2005 has been exploited as a privilege escalation component in multi-stage attacks. CISA confirmed active exploitation by including it in the KEV catalog. Local privilege escalation exploits for Windows kernel drivers are valuable to threat actors for post-exploitation activities and are frequently incorporated into attack toolkits. The EPSS score of 0.1% (49.3rd percentile) reflects the targeted nature of exploitation, as the vulnerability requires local access.
Remediation
- Apply Microsoft security update MS11-080 which addresses the privilege escalation vulnerability in the Ancillary Function Driver. Ensure all affected Windows XP and Server 2003 systems are patched.
- Migrate off Windows XP and Windows Server 2003 as these operating systems have long reached end of life and no longer receive security updates. Upgrade to a currently supported Windows version.
- Implement least privilege principles by ensuring users operate with standard (non-administrator) accounts for daily activities, limiting the impact of local privilege escalation attacks.
- Deploy endpoint detection and response (EDR) solutions that can detect privilege escalation attempts and suspicious kernel driver interactions.
- Segment and isolate legacy systems that cannot be immediately upgraded, restricting their network access and monitoring them for suspicious activity.
Technical Details
CVE-2011-2005 is a privilege escalation vulnerability (CWE-269) in the Ancillary Function Driver (afd.sys), a kernel-mode driver in Microsoft Windows that supports Windows Sockets applications. The vulnerability exists because the AFD driver does not properly validate user-mode input when processing certain I/O control (IOCTL) requests. A local authenticated attacker can craft specific IOCTL calls to the AFD driver that cause improper memory operations in kernel space, allowing the attacker to overwrite kernel memory and execute arbitrary code with SYSTEM privileges. The attack operates through the Windows Sockets API, which provides a low-level interface to the AFD driver, making it accessible to any application running with standard user permissions.
Frequently Asked Questions
Is CVE-2011-2005 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2011-2005 to the Known Exploited Vulnerabilities catalog. The vulnerability is used as a privilege escalation component in multi-stage attacks.
What products are affected by CVE-2011-2005?
Microsoft Windows XP SP2 and SP3, and Windows Server 2003 SP2 are affected. The vulnerability is in the Ancillary Function Driver (afd.sys) kernel component.
How do I fix CVE-2011-2005?
Apply Microsoft security update MS11-080. Since Windows XP and Server 2003 are end of life, the recommended approach is to migrate to a currently supported Windows operating system.
How severe is CVE-2011-2005?
CVE-2011-2005 has a CVSS v2 score of 7.2 (High) and enables local privilege escalation to SYSTEM level. While it requires local access, achieving SYSTEM privileges gives the attacker complete control of the affected machine, making it a critical post-exploitation tool.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.