CVE-2023-28229
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
Description
CVE-2023-28229 is an elevation of privilege vulnerability in the Microsoft Windows CNG Key Isolation Service, a core cryptographic component responsible for managing and protecting private keys. The vulnerability arises from a sensitive data storage issue (CWE-591) that allows a locally authenticated attacker with low privileges to escalate their access and gain full control over the affected system. Successfully exploiting CVE-2023-28229 can compromise the confidentiality, integrity, and availability of the Windows host. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 7.2% (91st percentile), organizations should prioritize patching across all affected Windows versions.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19869 |
| microsoft | windows 10 1607 | < 10.0.14393.5850 |
| microsoft | windows 10 1809 | < 10.0.17763.4252 |
| microsoft | windows 10 20h2 | < 10.0.19042.2846 |
| microsoft | windows 10 21h2 | < 10.0.19044.2846 |
| microsoft | windows 10 22h2 | < 10.0.19045.2846 |
| microsoft | windows 11 21h2 | < 10.0.22000.1817 |
| microsoft | windows 11 22h2 | < 10.0.22621.1555 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
| microsoft | windows server 2022 | - |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28229(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28229(US Government Resource)
Weakness Type
CWE-591: Sensitive Data Storage in Improperly Locked Memory
The Windows CNG Key Isolation Service fails to properly protect sensitive data stored in memory, allowing a local attacker to access or manipulate cryptographic key material that should be locked and inaccessible. In the context of CVE-2023-28229, this weakness enables privilege escalation by exploiting how the service manages memory containing sensitive cryptographic operations.
Learn more: CWE-591 — Sensitive Data Storage in Improperly Locked Memory
Impact Analysis
CVE-2023-28229 carries a CVSS 3.1 score of 7.0 (High severity), reflecting a serious elevation of privilege risk on Windows systems. The vulnerability requires local access to exploit, meaning an attacker must already have a foothold on the target machine, and the attack complexity is high, indicating that specific conditions must be met for successful exploitation. However, only low-level privileges are required and no user interaction is needed, making it feasible for any authenticated local user to attempt the attack. Confidentiality (High): A successful exploit grants the attacker access to sensitive cryptographic key material and potentially any data protected by those keys. Integrity (High): The attacker can modify system-level resources and escalate to administrative privileges, allowing unauthorized changes to the system. Availability (High): Exploitation can disrupt the CNG Key Isolation Service and dependent cryptographic operations, potentially causing system instability. While the scope remains unchanged (the impact is confined to the vulnerable component), the combination of full confidentiality, integrity, and availability impact makes this a high-priority vulnerability for remediation across all affected Windows deployments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-28229 in the wild by adding it to the Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of October 25, 2023. While no public exploit code or proof-of-concept has been identified in the available references, the KEV listing confirms that threat actors are leveraging this vulnerability in real-world attacks. The EPSS score of 7.2% places CVE-2023-28229 in the 91st percentile, indicating a significantly elevated likelihood of exploitation compared to most vulnerabilities. The ransomware association is currently listed as unknown, but given the privilege escalation nature of this flaw, it could serve as a critical step in a broader attack chain leading to full system compromise.
Remediation
- Apply Microsoft security updates immediately as directed by the KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Consult the Microsoft Security Response Center advisory for the specific patches applicable to your Windows version.
- Patch all affected Windows versions, including Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2), Windows 11 (versions 21H2, 22H2), and Windows Server (2008, 2012, 2016, 2019, 2022). Prioritize internet-facing and high-value systems.
- Restrict local access to systems running the CNG Key Isolation Service by enforcing least-privilege principles, removing unnecessary local accounts, and tightening group policy settings to limit who can log on locally.
- Monitor for indicators of compromise by reviewing Windows Security Event Logs for unusual privilege escalation activity, unexpected service restarts of the CNG Key Isolation Service, and anomalous access to cryptographic key stores.
- Implement defense-in-depth measures such as application whitelisting, endpoint detection and response (EDR) solutions, and network segmentation to limit the blast radius of any successful privilege escalation attempt.
Technical Details
CVE-2023-28229 exploits a flaw in the Windows CNG (Cryptography Next Generation) Key Isolation Service, which is responsible for isolating private key operations in a secure process to prevent unauthorized access. The underlying weakness, classified as CWE-591 (Sensitive Data Storage in Improperly Locked Memory), occurs when the service fails to properly lock memory regions containing sensitive cryptographic material, allowing a local attacker to read or manipulate this data. The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that while the attack requires local access and high complexity — suggesting the attacker must carefully time or orchestrate their exploitation attempt — the low privilege requirement means any standard user account can serve as the starting point. Once the improperly locked memory is accessed, the attacker can extract private keys or escalate privileges within the CNG Key Isolation Service context, ultimately achieving full control over the host system with high impact across all three CIA triad dimensions.
Frequently Asked Questions
Is CVE-2023-28229 being actively exploited?
Yes, CVE-2023-28229 is confirmed to be actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of October 25, 2023. While the ransomware association is currently unknown, the confirmed active exploitation makes immediate patching essential.
What products are affected by CVE-2023-28229?
CVE-2023-28229 affects a wide range of Microsoft Windows operating systems, including Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, and 22H2), Windows 11 (versions 21H2 and 22H2), and Windows Server (2008, 2012, 2016, 2019, and 2022). Both desktop and server editions are impacted.
How do I fix CVE-2023-28229?
Apply the security updates provided by Microsoft through the MSRC advisory for your specific Windows version. Additionally, restrict local access to affected systems, enforce least-privilege policies, and monitor for signs of privilege escalation. See the Remediation section for detailed steps.
How severe is CVE-2023-28229?
CVE-2023-28229 is rated High severity with a CVSS 3.1 score of 7.0. Although local access and high attack complexity are required, successful exploitation grants full control over the affected system. The EPSS score of 7.2% (91st percentile) indicates a significantly higher exploitation probability than most vulnerabilities, reinforcing the urgency to patch.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.