OnlyPatch
Windows Ancillary Function Driver for WinSock

CVE-2023-21768 — Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.65417 🔬 Patch diffed 2023-01 archive

Executive Summary

None

Overview

7.8
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-822: Untrusted Pointer Dereference
Released Jan 10 2023
Last Updated Jan 10 2023
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.65417 — 0.99192 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.8

EPSS Score

0.65417
probability of exploitation in the next 30 days
0.99192 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

6 affected products
Product KB Article Severity Impact Restart Required
Windows 11 version 21H2 for ARM64-based Systems 5022287 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for x64-based Systems 5022287 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5022303 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5022303 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5022291 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5022291 (Security Update) Important Elevation of Privilege Yes

Patches

3 patches
Article Type Restart
5022287 Security Update Yes
5022303 Security Update Yes
5022291 Security Update Yes

Patch Diff

ghidriff · afd.sys (KB5022303)

Patch diff 10.0.22621.608 -> 10.0.22621.1105 (single-function fix: AfdNotifyRemoveIoCompletion PreviousMode check)

Pre-patch version 10.0.22621.608
Post-patch version 10.0.22621.1105
Function Address Change Note
NTOSKRNL.EXE::ProbeForWrite EXTERNAL:00000041 refcount similarity 1.0
AfdNotifyRemoveIoCompletion 1c006f92c code, length similarity 1.0
View full diff report View RCA report Download PoC

Attack Path

Local EoP to SYSTEM via an arbitrary kernel write in AfdNotifySock - PreviousMode never checked on the output pointer

Attack path for CVE-2023-21768 Local EoP to SYSTEM via an arbitrary kernel write in AfdNotifySock - PreviousMode never checked on the output pointer 01 — ENTRY Attacker opens a socket and issues the AFD notify IOCTL DeviceIoControl(hSocket, IOCTL_AFD_NOTIFY_SOCK 0x12127). Winsock is reachable by any unprivileged user; afd.sys is always loaded. 02 — CONTROLLED INPUT Supplies a 0x30-byte AFD_NOTIFYSOCK_STRUCT with a kernel address at +0x18 AfdNotifySock validates InputBufferLength == 0x30 and resolves the completion handle, but field_0x18 is copied through as an output pointer under attacker control. 03 — PATH AfdNotifyRemoveIoCompletion runs and produces a value to write back ProbeForWrite is applied to pStruct->pData2 for dwLen * 0x20 bytes, then IoRemoveCompletion -> KeRemoveQueueEx returns a completion count. 04 — MISSING CHECK The completion count is written through field_0x18 with no PreviousMode check ProbeForWrite guards pData2 but never field_0x18, and the write happens regardless of whether the request came from user or kernel mode. The patch adds the missing PreviousMode validation. 05 — PRIMITIVE Arbitrary kernel-address write of a controlled small integer *pStruct->field_0x18 = writeValue lands anywhere in kernel space. Aiming it at a token privilege field or a page-table entry escalates to SYSTEM.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

15 public PoCs
RepositoryStarsPublishedDescription
chompie1337/Windows_LPE_AFD_CVE-2023-21768 506 2023-03-07 LPE exploit for CVE-2023-21768
SamuelTulach/nullmap 200 2023-03-10 Using CVE-2023-21768 to manual map kernel mode driver
Malwareman007/CVE-2023-21768 65 2023-03-13 Windows_AFD_LPE_CVE-2023-21768
cl4ym0re/cve-2023-21768-compiled 27 2023-03-10 cve-2023-21768
P4x1s/CVE-2023-21768-POC 23 2023-03-22 CVE-2023-21768 Windows 11 22H2 系统本地提权 POC
zoemurmure/CVE-2023-21768-AFD-for-WinSock-EoP-exploit 15 2023-04-20
xboxoneresearch/CVE-2023-21768-dotnet 15 2024-05-15 C# / .NET version of CVE-2023-21768
h1bAna/CVE-2023-21768 3 2023-04-05
Rosayxy/Recreate-cve-2023-21768 1 2023-10-02 recreating exp for cve-2023-21768.
IlanDudnik/CVE-2023-21768 1 2024-12-30 Exploit implementation with IO Rings for CVE-2023-21768
ivanovick1/Windows_AFD_LPE_CVE-2023-21768 0 2023-08-21 Windows 11 System Permission Elevation
ldrx30/CVE-2023-21768 0 2024-04-07 CVE-2023-21768 Proof of Concept
radoi-teodor/CVE-2023-21768-DSE-Bypass 0 2025-08-25
Feede33/Windows-11-Exploit 0 2026-01-20 https://github.com/chompie1337/Windows_LPE_AFD_CVE-2023-21768
leandrofleury/CVE-2023-21768 0 2026-06-15

Detection Rules

Acknowledgments

None

On This Page