CVE-2023-23376
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Description
CVE-2023-23376 is an elevation of privilege vulnerability in the Windows Common Log File System (CLFS) Driver caused by a heap-based buffer overflow. This vulnerability affects a wide range of Microsoft Windows versions, including Windows 10, Windows 11, and Windows Server 2008 through 2022. By exploiting this CLFS driver flaw, a local attacker with low-level privileges can gain SYSTEM-level access, achieving full control over the affected machine. CISA has added CVE-2023-23376 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and it has been linked to ransomware campaigns. With an EPSS score of 21.1% (95th percentile), this vulnerability poses a significant and ongoing threat to Windows environments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19747 |
| microsoft | windows 10 1607 | < 10.0.14393.5717 |
| microsoft | windows 10 1809 | < 10.0.17763.4010 |
| microsoft | windows 10 20h2 | < 10.0.19042.2604 |
| microsoft | windows 10 21h2 | < 10.0.19044.2604 |
| microsoft | windows 10 22h2 | < 10.0.19045.2604 |
| microsoft | windows 11 21h2 | < 10.0.22000.1574 |
| microsoft | windows 11 22h2 | < 10.0.22621.1265 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.5717 |
| microsoft | windows server 2019 | < 10.0.17763.4010 |
| microsoft | windows server 2022 | < 10.0.20348.1540 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23376(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23376(US Government Resource)
Weakness Type
CWE-122: Heap-based Buffer Overflow
The Windows Common Log File System Driver contains a heap-based buffer overflow that allows an attacker to write data beyond the allocated memory boundary on the heap. In the context of the CLFS driver, this overflow enables corruption of adjacent kernel memory structures, which can be leveraged to escalate privileges to SYSTEM level.
Learn more: CWE-122 — Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write
CWE-787 describes a condition where software writes data past the boundaries of an allocated buffer. In CVE-2023-23376, the CLFS driver fails to properly validate input sizes, allowing an attacker to trigger an out-of-bounds write in kernel memory, ultimately enabling privilege escalation.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
Attack Vector (Local): CVE-2023-23376 requires local access to the target system, meaning an attacker must already have a foothold on the machine, such as through a compromised user account or another initial access vulnerability. Attack Complexity (Low): Exploitation is straightforward with no special conditions required, making it accessible to a wide range of threat actors. Privileges Required (Low): Only low-level user privileges are needed to trigger the vulnerability, and no user interaction is required, meaning the exploit can run silently without any action from a logged-in user. Confidentiality, Integrity, and Availability (all High): Successful exploitation grants SYSTEM-level privileges, giving the attacker complete control over all data, system configurations, and the ability to disrupt operations entirely. With a CVSS score of 7.8 (High) and confirmed use in ransomware operations, this vulnerability represents a critical risk for any organization running unpatched Windows systems. The EPSS score of 21.1% places it in the 95th percentile, indicating a substantially elevated probability of exploitation.
Exploit Maturity
Active exploitation of CVE-2023-23376 has been confirmed by CISA, which added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of March 7, 2023. Notably, this CLFS driver vulnerability has been associated with known ransomware campaigns, underscoring its use by financially motivated threat actors. The EPSS score of 21.1% (95th percentile) indicates a high probability of exploitation activity. While no public proof-of-concept exploit code has been identified in tracked reference sources, the confirmed in-the-wild exploitation and ransomware association make immediate patching essential.
Remediation
- Apply Microsoft security updates immediately. Install the February 2023 Patch Tuesday update that addresses CVE-2023-23376 for all affected Windows versions. As directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Refer to the Microsoft Security Update Guide for version-specific patches.
- Prioritize patching across all Windows editions. This vulnerability affects Windows 10 (versions 1507 through 22H2), Windows 11 (21H2 and 22H2), and Windows Server 2008 through 2022. Ensure all systems in your environment are inventoried and updated, including legacy Server 2008 and 2012 installations.
- Restrict local access and enforce least privilege. Since exploitation requires local access with low privileges, reduce the attack surface by limiting user accounts to only the permissions they need. Implement application whitelisting and restrict access to sensitive systems.
- Monitor for signs of privilege escalation. Review Windows event logs for unusual SYSTEM-level process creation, unexpected CLFS log file manipulation, and anomalous driver behavior. Deploy endpoint detection and response (EDR) tools to detect post-exploitation activity.
- Implement defense-in-depth against ransomware. Given the confirmed ransomware association, ensure offline backups are current, network segmentation isolates critical assets, and anti-ransomware detection rules are active across your security stack.
Technical Details
Vulnerability Mechanism: CVE-2023-23376 resides in the Windows Common Log File System (CLFS) driver, a kernel-mode component responsible for managing transactional log files. The vulnerability stems from a heap-based buffer overflow (CWE-122) combined with an out-of-bounds write (CWE-787), where the driver fails to properly validate the size of data being written to heap-allocated buffers during CLFS log file processing. Exploitation Path: An attacker with low-level local access crafts a malicious CLFS log file or manipulates CLFS API calls to trigger the overflow condition, corrupting adjacent kernel heap metadata. This memory corruption is then leveraged to overwrite critical kernel data structures, enabling the attacker to escalate privileges from a standard user to SYSTEM. CVSS Vector Analysis: The vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms that while local access is required, the low attack complexity and absence of user interaction make this a reliable exploitation target once an attacker has any foothold on the system.
Frequently Asked Questions
Is CVE-2023-23376 being actively exploited?
Yes, CVE-2023-23376 is being actively exploited in the wild. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of March 7, 2023. Additionally, exploitation of this CLFS driver vulnerability has been linked to ransomware campaigns.
What products are affected by CVE-2023-23376?
CVE-2023-23376 affects a broad range of Microsoft Windows products, including Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, and 22H2), Windows 11 (versions 21H2 and 22H2), and Windows Server 2008, 2012, 2016, 2019, and 2022. Both desktop and server editions are vulnerable.
How do I fix CVE-2023-23376?
Apply the February 2023 security update from Microsoft for all affected Windows versions. Visit the Microsoft Security Update Guide for version-specific patches. In the interim, restrict local user privileges, monitor for unusual SYSTEM-level process creation, and ensure ransomware defenses including offline backups are in place.
How severe is CVE-2023-23376?
CVE-2023-23376 carries a CVSS score of 7.8 (High severity). The EPSS score of 21.1% places it in the 95th percentile, indicating a significantly elevated likelihood of exploitation. Combined with confirmed ransomware usage and active exploitation, this vulnerability should be treated as a high-priority patching target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.