CVE-2023-28252
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Description
CVE-2023-28252 is a high-severity elevation of privilege vulnerability in the Windows Common Log File System (CLFS) driver affecting a wide range of Microsoft Windows versions, including Windows 10, Windows 11, and Windows Server 2008 through 2022. The vulnerability stems from a heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) in the clfs.sys driver, allowing a locally authenticated attacker to gain SYSTEM-level privileges without any user interaction. CVE-2023-28252 has been actively exploited in the wild and is confirmed to have been used in ransomware campaigns, making it an extremely high-priority vulnerability for patching. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of May 2, 2023, and the EPSS score of 56.5% (98th percentile) underscores the near-certain probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.19869 |
| microsoft | windows 10 1607 | < 10.0.14393.5850 |
| microsoft | windows 10 1809 | < 10.0.17763.4252 |
| microsoft | windows 10 20h2 | < 10.0.19042.2846 |
| microsoft | windows 10 21h2 | < 10.0.19044.2846 |
| microsoft | windows 10 22h2 | < 10.0.19045.2846 |
| microsoft | windows 11 21h2 | < 10.0.22000.1817 |
| microsoft | windows 11 22h2 | < 10.0.22621.1555 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
| microsoft | windows server 2022 | - |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252(Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/174668/Windows-Common-Log-File-System-Driver-clfs.sys-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-28252(US Government Resource)
Weakness Type
CWE-122: Heap-based Buffer Overflow
In CVE-2023-28252, the Windows Common Log File System driver contains a heap-based buffer overflow where input data can exceed the allocated memory buffer on the heap. This overflow in the CLFS driver allows an attacker to corrupt adjacent memory structures and ultimately achieve arbitrary code execution with elevated SYSTEM privileges.
Learn more: CWE-122 — Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write
The CLFS driver vulnerability also involves an out-of-bounds write condition where the software writes data past the boundaries of the intended buffer. This out-of-bounds write in clfs.sys enables manipulation of kernel memory, providing a reliable path to privilege escalation on affected Windows systems.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2023-28252 carries a CVSS v3.1 score of 7.8 (High severity), reflecting the severe impact achievable through local exploitation of the Windows CLFS driver. Attack Vector (Local): the vulnerability requires the attacker to have local access to the target system, typically achieved through an initial compromise such as phishing or a separate remote vulnerability. Attack Complexity (Low): exploitation is reliable and does not require special conditions or timing. Privileges Required (Low): only standard user-level privileges are needed to trigger the vulnerability, making it accessible to any authenticated user on the system. User Interaction (None): no action from another user is required. Confidentiality, Integrity, and Availability (all High): a successful exploit elevates the attacker to SYSTEM-level privileges, granting complete control over the Windows system including access to all files, the ability to install persistent backdoors, modify security configurations, and disrupt system operations. The confirmed ransomware association makes this vulnerability particularly dangerous, as attackers are actively using it to deploy ransomware payloads after gaining initial access. With an EPSS score of 56.5% (98th percentile), exploitation attempts are highly probable across exposed systems.
Exploit Maturity
CVE-2023-28252 represents a mature and actively weaponized vulnerability with a well-developed exploit ecosystem. Public exploit code is available for CVE-2023-28252 via Packet Storm Security, providing a functional privilege escalation exploit targeting the clfs.sys driver. Active Exploitation: CISA has confirmed active exploitation in the wild and added this vulnerability to the KEV catalog with a deadline of May 2, 2023. Ransomware Usage: this vulnerability is confirmed to be used in ransomware campaigns, where threat actors leverage the CLFS driver exploit to escalate from a standard user to SYSTEM privileges before deploying ransomware payloads. The EPSS score of 56.5% (98th percentile) indicates near-certain exploitation activity, making this one of the most actively targeted privilege escalation vulnerabilities in the Windows ecosystem.
Remediation
- Apply the Microsoft security update immediately. Install the April 2023 Patch Tuesday update for CVE-2023-28252 from the Microsoft Security Response Center. CISA requires mitigations to be applied by May 2, 2023, or the product must be discontinued if mitigations are unavailable.
- Patch all affected Windows versions. This vulnerability affects Windows 10 (1507, 1607, 1809, 20H2, 21H2, 22H2), Windows 11 (21H2, 22H2), and Windows Server 2008, 2012, 2016, 2019, and 2022. Prioritize patching systems that are internet-facing or accessible to untrusted users.
- Implement least-privilege access controls. Since exploitation requires low-level local privileges, enforce strict user access policies to limit the number of accounts with local logon rights. Remove unnecessary local administrator access and implement application whitelisting to prevent unauthorized code execution.
- Monitor for exploitation indicators. Review Windows event logs for anomalous CLFS driver activity, unexpected SYSTEM-level process creation, and signs of ransomware staging. Deploy endpoint detection and response (EDR) solutions with signatures for known CLFS exploitation techniques.
- Deploy defense-in-depth against ransomware. Given the confirmed ransomware association, implement network segmentation, maintain offline backups, enforce multi-factor authentication, and ensure endpoint protection solutions are updated with the latest ransomware detection signatures.
Technical Details
CVE-2023-28252 is an elevation of privilege vulnerability in the Windows Common Log File System (CLFS) driver (clfs.sys), caused by a heap-based buffer overflow (CWE-122) combined with an out-of-bounds write condition (CWE-787). Vulnerability Mechanism: the CLFS driver improperly handles certain log file structures, allowing a locally authenticated attacker to trigger a heap buffer overflow that corrupts adjacent kernel memory. The out-of-bounds write enables the attacker to overwrite critical kernel data structures, achieving arbitrary write primitives that can be leveraged for SYSTEM-level privilege escalation. CVSS Vector Analysis (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): the local attack vector means the attacker must first gain code execution on the target system, but the low attack complexity and low privilege requirement make exploitation reliable from any standard user account. The unchanged scope indicates the impact remains within the Windows kernel boundary, but achieving SYSTEM privileges effectively grants complete control over the operating system. The CLFS driver has been a recurring target for privilege escalation exploits, with multiple vulnerabilities discovered in the same component across different Windows versions, reflecting a systemic weakness in the driver's memory management and input validation logic.
Frequently Asked Questions
Is CVE-2023-28252 being actively exploited?
Yes, CVE-2023-28252 is actively exploited in the wild and has been confirmed for use in ransomware campaigns. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of May 2, 2023. Public exploit code is also available, further increasing the risk.
What products are affected by CVE-2023-28252?
CVE-2023-28252 affects a wide range of Microsoft Windows products including Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2), Windows 11 (versions 21H2, 22H2), and Windows Server 2008, 2012, 2016, 2019, and 2022. All editions and architectures of these versions are impacted.
How do I fix CVE-2023-28252?
To remediate CVE-2023-28252, apply the April 2023 security update from Microsoft available through Windows Update or the Microsoft Update Catalog. Prioritize patching systems accessible to untrusted users and implement least-privilege access controls as an additional safeguard. Refer to the Remediation section for comprehensive steps.
How severe is CVE-2023-28252?
CVE-2023-28252 is rated High severity with a CVSS v3.1 score of 7.8. However, its real-world severity is amplified by confirmed ransomware usage, public exploit availability, and an EPSS score of 56.5% (98th percentile) indicating near-certain exploitation. This makes it one of the highest-priority Windows privilege escalation vulnerabilities to address.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.