CVE-2023-36036
Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability
Description
CVE-2023-36036 is a heap-based buffer overflow vulnerability in the Microsoft Windows Cloud Files Mini Filter Driver that allows local attackers to escalate their privileges. This out-of-bounds write flaw affects a wide range of Windows versions, including Windows 10, Windows 11, and Windows Server editions from 2008 through 2022. By exploiting CVE-2023-36036, an attacker with low-level access to the system can gain elevated privileges, potentially achieving full control over the affected Windows machine. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of December 5, 2023, confirming that the Windows Cloud Files Mini Filter Driver elevation of privilege vulnerability is being actively exploited in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20308 |
| microsoft | windows 10 1607 | < 10.0.14393.6452 |
| microsoft | windows 10 1809 | < 10.0.17763.5122 |
| microsoft | windows 10 21h2 | < 10.0.19041.3693 |
| microsoft | windows 10 22h2 | < 10.0.19045.3693 |
| microsoft | windows 11 21h2 | < 10.0.22000.2600 |
| microsoft | windows 11 22h2 | < 10.0.22621.2715 |
| microsoft | windows 11 23h2 | < 10.0.22621.2715 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.6452 |
| microsoft | windows server 2019 | < 10.0.17763.5122 |
| microsoft | windows server 2022 | < 10.0.20348.2113 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36036(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36036(US Government Resource)
Weakness Type
CWE-122: Heap-based Buffer Overflow
In the context of CVE-2023-36036, the Windows Cloud Files Mini Filter Driver fails to properly validate buffer boundaries when processing data in heap memory, allowing an attacker to write beyond allocated buffers. This heap-based buffer overflow can corrupt adjacent memory structures, enabling privilege escalation on the affected Windows system.
Learn more: CWE-122 — Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write
The underlying out-of-bounds write weakness in the Cloud Files Mini Filter Driver permits writing data past the intended memory boundary. This type of memory corruption vulnerability in Windows kernel-mode drivers is particularly dangerous as it can be leveraged to execute arbitrary code with elevated privileges.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2023-36036 carries a CVSS 3.1 score of 7.8 (High), reflecting a significant elevation of privilege risk on affected Windows systems. The vulnerability requires local access to the target machine and low privileges to exploit, but demands no user interaction, meaning an attacker who already has a foothold on the system can escalate privileges without any action from the user. Confidentiality (High): successful exploitation grants the attacker access to sensitive data and system resources normally restricted to higher-privileged accounts. Integrity (High): the attacker can modify system files, install persistent backdoor mechanisms, and alter security configurations. Availability (High): the attacker could destabilize the system or terminate critical services. The scope remains unchanged, meaning the impact is confined to the vulnerable Windows component, though elevated privileges effectively give the attacker control over the entire operating system.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-36036 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a mandatory remediation deadline of December 5, 2023. While the ransomware association is currently listed as unknown, the active exploitation status demands immediate attention. The EPSS score of 0.92% places this vulnerability in the 75th percentile, indicating moderate but growing exploitation probability. No public exploit code or proof-of-concept has been identified in the available references, though the confirmed in-the-wild exploitation demonstrates that threat actors already possess working exploits.
Remediation
- Apply Microsoft security updates immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Install the November 2023 Patch Tuesday updates from the Microsoft Security Update Guide.
- Patch all affected Windows versions, including Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server 2008, 2012, 2016, 2019, and 2022. Prioritize internet-facing servers and systems with multiple user accounts.
- Restrict local access to critical systems by enforcing least-privilege access policies, limiting the number of accounts with local logon rights, and segmenting high-value systems from general-purpose workstations to reduce the attack surface for local privilege escalation.
- Monitor for indicators of compromise by reviewing Windows Security Event Logs for unusual privilege escalation patterns, unexpected process creation under SYSTEM context, and anomalous activity involving the Cloud Files Mini Filter Driver (cldflt.sys).
- Implement endpoint detection and response (EDR) rules to detect heap-based buffer overflow exploitation patterns in kernel-mode drivers, and consider deploying application control policies to limit the execution of untrusted code on sensitive systems.
Technical Details
CVE-2023-36036 exploits a heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) condition in the Windows Cloud Files Mini Filter Driver (cldflt.sys), a kernel-mode component responsible for handling cloud file synchronization operations. The vulnerability arises when the driver improperly validates the size of input data before writing it to a heap-allocated buffer, allowing an attacker to overwrite adjacent kernel memory. As reflected in the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), exploitation requires local access with low privileges but no user interaction, and the low attack complexity indicates that no special conditions or race conditions are needed to trigger the overflow. The two CWE classifications are closely related: CWE-787 describes the general out-of-bounds write behavior, while CWE-122 specifies that this write occurs on the heap, which in a kernel-mode driver context enables the attacker to corrupt kernel data structures and escalate privileges to SYSTEM level.
Frequently Asked Questions
Is CVE-2023-36036 being actively exploited?
Yes, CVE-2023-36036 is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 5, 2023. While the ransomware usage status is currently unknown, the confirmed active exploitation makes immediate patching essential.
What products are affected by CVE-2023-36036?
CVE-2023-36036 affects a broad range of Microsoft Windows products, including Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2), Windows 11 (versions 21H2, 22H2, 23H2), and Windows Server 2008, 2012, 2016, 2019, and 2022. Both desktop and server editions of Windows are vulnerable.
How do I fix CVE-2023-36036?
Apply the November 2023 security updates from Microsoft for all affected Windows versions. The patches are available through the Microsoft Security Update Guide. Additionally, restrict local access to critical systems and monitor for signs of privilege escalation activity.
How severe is CVE-2023-36036?
CVE-2023-36036 has a CVSS 3.1 score of 7.8, rated as High severity. The EPSS score places it in the 75th percentile for exploitation probability. While local access is required, the low attack complexity and no user interaction requirement make this a significant threat on any system where an attacker has established initial access.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.