PatchaPalooza

CVE-2023-21674: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

CVE-2023-21674 is an elevation of privilege vulnerability in Windows Advanced Local Procedure Call (ALPC), rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft reports that it has been exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on 10 January 2023, with a remediation deadline of 31 January 2023 for US federal agencies. The EPSS model estimates a 34.21% probability of exploitation activity in the next 30 days, higher than 98% of all scored vulnerabilities. Microsoft released the fix on 10 January 2023 in the January 2023 Patch Tuesday, delivered through 9 security updates (KB5022286, KB5022291, KB5022282, KB5022287 and more). It affects 30 products in 2 product families (Windows, ESU).

Key facts

CVE ID
CVE-2023-21674
Severity
High CVSS 8.8
Microsoft severity
Important
Impact
Elevation of Privilege
Exploited in the wild
Yes
Publicly disclosed
No
Exploitation likelihood
Detected
Weakness
CWE-416
EPSS
34.21% (percentile 98%)
CISA KEV
Listed , due
Released
Last updated
Patch Tuesday
January 2023 Patch Tuesday
Product families
Windows, ESU

CVSS score and vector

Microsoft scores CVE-2023-21674 at 8.8 (temporal 8.2) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C

MetricValue
Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityFunctional
Remediation levelOfficial fix
Report confidenceConfirmed

Frequently asked questions (Microsoft)

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

This vulnerability could lead to a browser sandbox escape.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected products (30)

Windows

ProductSecurity updateTypeFixed buildRestart
Windows 10 Version 1809 for 32-bit SystemsKB5022286Security Update10.0.17763.3887Yes
Windows 10 Version 1809 for x64-based SystemsKB5022286Security Update10.0.17763.3887Yes
Windows 10 Version 1809 for ARM64-based SystemsKB5022286Security Update10.0.17763.3887Yes
Windows Server 2019KB5022286Security Update10.0.17763.3887Yes
Windows Server 2019 (Server Core installation)KB5022286Security Update10.0.17763.3887Yes
Windows Server 2022KB5022291Security Update10.0.20348.1487Yes
Windows Server 2022 (Server Core installation)KB5022291Security Update10.0.20348.1487Yes
Windows 10 Version 20H2 for 32-bit SystemsKB5022282Security Update10.0.19042.2486Yes
Windows 10 Version 20H2 for ARM64-based SystemsKB5022282Security Update10.0.19042.2486Yes
Windows 11 version 21H2 for x64-based SystemsKB5022287Security Update10.0.22000.1455Yes
Windows 11 version 21H2 for ARM64-based SystemsKB5022287Security Update10.0.22000.1455Yes
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based SystemsKB5022303Security Update10.0.22621.1105Yes
Windows 11 Version 22H2 for x64-based SystemsKB5022303Security Update10.0.22621.1105Yes
Windows 10 Version 22H2 for x64-based Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 for 32-bit SystemsKB5022297Security Update10.0.10240.19685Yes
Windows 10 for x64-based SystemsKB5022297Security Update10.0.10240.19685Yes
Windows 10 Version 1607 for 32-bit SystemsKB5022289Security Update10.0.14393.5648Yes
Windows 10 Version 1607 for x64-based SystemsKB5022289Security Update10.0.14393.5648Yes
Windows Server 2016KB5022289Security Update10.0.14393.5648Yes
Windows Server 2016 (Server Core installation)KB5022289Security Update10.0.14393.5648Yes
Windows 8.1 for 32-bit systemsKB5022352
KB5022346		Monthly Rollup
Security Only		6.3.9600.20778
6.3.9600.20778		Yes
Yes
Windows 8.1 for x64-based systemsKB5022352
KB5022346		Monthly Rollup
Security Only		6.3.9600.20778
6.3.9600.20778		Yes
Yes
Windows RT 8.1KB5022346Security Only6.3.9600.20778Yes

ESU

ProductSecurity updateTypeFixed buildRestart
Windows Server 2012 R2KB5022352
KB5022346		Monthly Rollup
Security Only		6.3.9600.20778
6.3.9600.20778		Yes
Yes
Windows Server 2012 R2 (Server Core installation)KB5022352
KB5022346		Monthly Rollup
Security Only		6.3.9600.20778
6.3.9600.20778		Yes
Yes

Security updates (9)

Exploitation and detection

CISA Known Exploited Vulnerabilities

Date added
Federal due date
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.

VulnCheck KEV

Date added
Ransomware use
Unknown
Independent sources
4

Public exploits (1)

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (1)

NIST NVD data

NVD status
Analyzed
NVD CVSS
8.8 (HIGH)
NVD weakness
CWE-416
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
windows 10 1507before 10.0.10240.19685
windows 10 1607before 10.0.14393.5648
windows 10 1809before 10.0.17763.3887
windows 10 20h2before 10.0.19042.2486
windows 10 21h2before 10.0.19044.2486
windows 10 22h2before 10.0.19045.2486
windows 11 21h2before 10.0.22000.1455
windows 11 22h2before 10.0.22621.1105
windows rt 8.1all listed versions
windows server 2012 r2all listed versions
windows server 2016before 10.0.14393.5648
windows server 2019before 10.0.17763.3887
windows server 2022before 10.0.20348.1487

References

Acknowledgments

  • Jan Vojtěšek, Milánek, and Przemek Gmerek with Avast

Revision history

VersionDateDescription
1.0Information published.

Sources