CVE-2023-29346
📋 TL;DR
This vulnerability allows an authenticated attacker to exploit a flaw in the NTFS filesystem driver to elevate privileges from a standard user account to SYSTEM level. It affects Windows systems where an attacker has local access and can execute code. The vulnerability requires the attacker to already have some level of access to the target system.
💻 Affected Systems
- Windows 10
- Windows 11
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where an attacker gains SYSTEM privileges, enabling them to install programs, view/change/delete data, create new accounts, and bypass security controls.
Likely Case
Privilege escalation from a standard user account to SYSTEM, allowing attackers to bypass application restrictions, access sensitive system files, and maintain persistence.
If Mitigated
Limited impact if proper access controls, least privilege principles, and network segmentation are implemented, restricting lateral movement.
🎯 Exploit Status
Exploitation requires local access and some technical knowledge. Proof-of-concept code has been published.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: May 2023 security updates (KB5026372 for Windows 10, KB5026373 for Windows 11, etc.)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29346
Restart Required: Yes
Instructions:
1. Apply May 2023 Windows security updates via Windows Update. 2. For enterprise environments, deploy updates through WSUS or SCCM. 3. Restart systems after update installation.
🔧 Temporary Workarounds
Restrict local access
windowsLimit local user access to systems through proper access controls and least privilege principles.
Enable Windows Defender Exploit Guard
windowsConfigure Exploit Guard to detect and block privilege escalation attempts.
🧯 If You Can't Patch
- Implement strict access controls and least privilege for all user accounts
- Monitor for privilege escalation attempts using security tools and audit logs
🔍 How to Verify
Check if Vulnerable:
Check if May 2023 security updates are installed via 'wmic qfe list' or 'Get-Hotfix -Id KB5026372' in PowerShell.Check Version:
wmic os get caption,version,buildnumberVerify Fix Applied:
Verify May 2023 security updates are installed and system has been restarted since installation.📡 Detection & Monitoring
Log Indicators:
- Event ID 4688 with suspicious process creation, Event ID 4672 (special privileges assigned), unexpected SYSTEM privilege usage
Network Indicators:
- Lateral movement attempts from compromised systems
SIEM Query:
EventID=4688 AND NewProcessName CONTAINS 'cmd.exe' OR 'powershell.exe' AND SubjectUserName != SYSTEM AND TokenElevationType != %%1936