CVE-2023-32021: Windows SMB Witness Service Security Feature Bypass Vulnerability

Overview

Severity

High (CVSS 7.1)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C

Category

Security Feature Bypass

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2023-Jun

Released

2023-06-13

EPSS Score

1.74% (percentile: 82.5%)

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker who successfully exploited this vulnerability could execute RPC procedures that are restricted to privileged accounts, bypassing the access check for the RPC procedures. How could an attacker exploit the vulnerability? To exploit this vulnerability, an attacker could execute a specially crafted malicious script which executes an RPC call to a Windows SMB Witness Service.

Affected Products (8)

Windows

• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows Server 2022
• Windows Server 2022 (Server Core installation)
• Windows Server 2016
• Windows Server 2016 (Server Core installation)

ESU

• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core installation)

Security Updates (6)

• 5027222
• 5027225
• 5027319
• 5027219
• 5027271
• 5027282

Acknowledgments

Anonymous

Revision History

• 2023-06-13: Information published.