OnlyPatch
Windows CNG Key Isolation Service

CVE-2023-28229 — Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Important CVSS 7 EPSS 0.01872 🔬 Patch diffed 2023-04 archive

Executive Summary

None

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-591: Sensitive Data Storage in Improperly Locked Memory
Released Apr 11 2023
Last Updated Apr 11 2023
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.01872 — 0.77191 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.01872
probability of exploitation in the next 30 days
0.77191 percentile - updated 2026-07-25
View on FIRST.org

Affected Products

25 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 5025234 (Security Update) Important Elevation of Privilege Yes
Windows 10 for x64-based Systems 5025234 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for 32-bit Systems 5025228 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5025228 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5025229 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for ARM64-based Systems 5025229 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5025229 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 20H2 for 32-bit Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 20H2 for ARM64-based Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5025221 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for ARM64-based Systems 5025224 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for x64-based Systems 5025224 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5025239 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5025239 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5025271 (Monthly Rollup) 5025273 (Security Only) Important Elevation of Privilege 5023755 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5025271 (Monthly Rollup) 5025273 (Security Only) Important Elevation of Privilege 5023755 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 for x64-based Systems Service Pack 2 5025271 (Monthly Rollup) 5025273 (Security Only) Important Elevation of Privilege 5023755 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5025271 (Monthly Rollup) 5025273 (Security Only) Important Elevation of Privilege 5023755 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.0.6003.22015 Yes 5025271 5025273 Windows Server 2008 R2 for x64-based Systems Service Pack 1 5025279 (Monthly Rollup) 5025277 (Security Only) Important Elevation of Privilege 5023769 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.26466 Yes 5025279 5025277 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5025279 (Monthly Rollup) 5025277 (Security Only) Important Elevation of Privilege 5023769 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.1.7601.26466 Yes 5025279 5025277 Windows Server 2012 5025287 (Monthly Rollup) 5025272 (Security Only) Important Elevation of Privilege 5023769 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.2.9200.24216 Yes None Windows Server 2012 (Server Core installation) 5025287 (Monthly Rollup) 5025272 (Security Only) Important Elevation of Privilege 5023769 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.2.9200.24216 Yes None Windows Server 2012 R2 5025285 (Monthly Rollup) 5025288 (Security Only) Important Elevation of Privilege 5023765 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.3.9600.20919 Yes None Windows Server 2012 R2 (Server Core installation) 5025285 (Monthly Rollup) 5025288 (Security Only) Important Elevation of Privilege 5023765 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 6.3.9600.20919 Yes None Windows Server 2016 5025228 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5025228 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5025229 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5025229 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5025230 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5025230 (Security Update) Important Elevation of Privilege Yes

Patches

7 patches
Article Type Restart
5025234 Security Update Yes
5025228 Security Update Yes
5025229 Security Update Yes
5025221 Security Update Yes
5025224 Security Update Yes
5025239 Security Update Yes
5025230 Security Update Yes

Patch Diff

ghidriff · keyiso.dll (KB5025239)

Patch diff 10.0.22621.819 -> 10.0.22621.1555

Pre-patch version 10.0.22621.819 Download
Post-patch version 10.0.22621.1555 Download
Function Address Change Note
__GSHandlerCheck 1800050c8 -> 180004ed8 refcount, address similarity 1.0
SrvAddKeyToList 18000cdd4 -> 180001a0c code, length, sig, address similarity 0.34
_guard_xfg_dispatch_icall_nop 1800051a0 -> 180004fb0 refcount, address, calling similarity 0.89
SrvRundownProviderList 18000d910 -> 18000ce20 length, address, called similarity 0.75
SrvCryptImportKey 180002200 -> 180002630 code, refcount, length, sig, address, called similarity 0.06
SrvDereferenceProvider 18000d044 -> 18000c618 length, address similarity 0.62
SrvCryptCreatePersistedKey 180008000 -> 180007870 code, length, address, called similarity 0.41
SrvCryptRundownContext 180002d30 -> 180003370 length, address, called similarity 0.82
SrvCryptSecretAgreement 1800098f0 -> 180009130 code, length, sig, address, called similarity 0.22
SrvRemoveKeyFromList 18000d51c -> 180001aac code, length, sig, address similarity 0.44
SrvDereferenceKey 18000cff8 -> 18000c5c8 length, address similarity 0.67
NormalizeNteStatus 18000e7b4 -> 18000dc74 refcount, address similarity 1.0
SrvCryptGetKeyProperty 1800035f0 -> 180003d60 length, address, called similarity 0.48
SrvRundownKeyList 18000d6c8 -> 18000cbd4 length, address, called similarity 0.75
SrvCryptExportKey 180001df0 -> 180002090 length, address, called similarity 0.97
SrvLookupAndReferenceProvider 18000d168 -> 18000c744 length, address similarity 0.97
SrvCryptOpenStorageProvider 180001900 -> 180001ba0 code, length, address similarity 0.59
SrvFreeKey 18000a314 -> 1800018f0 code, length, address, calling, called similarity 0.68
SrvLookupAndReferenceKey 18000d0b8 -> 18000c694 length, address similarity 0.97
SrvFreeProvider 18000a3cc -> 18000197c code, length, address, called similarity 0.79
SrvRundownSecretList 18000daec -> 18000d000 length, address, called similarity 0.86
__security_check_cookie 180003fa0 -> 180004710 refcount, address, calling similarity 1.0
SrvRemoveProviderFromList 18000d588 -> 180001b20 code, length, sig, address similarity 0.44
API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL::GetProcAddress EXTERNAL:0000003d -> EXTERNAL:0000003e refcount, address, calling similarity 1.0
SrvCryptFreeProvider 180001fd0 -> 180002280 code, refcount, length, sig, address, called similarity 0.1
s_SrvRpcCryptEncrypt 18000ba50 -> 18000b0b0 code, length, sig, address, called similarity 0.48
SrvAddMemoryBufferToList 18000ce64 -> 18000c414 length, sig, address similarity 0.43
NTDLL.DLL::RtlFreeHeap EXTERNAL:00000012 refcount, calling similarity 1.0
SrvDereferenceSecret 18000d06c -> 18000c644 length, address similarity 0.67
s_SrvRpcCryptDecrypt 18000b630 -> 18000acb0 code, length, sig, address, called similarity 0.48
SrvLookupAndReferenceSecret 18000d218 -> 18000c7f4 length, address similarity 0.97
SrvCryptOpenKey 180002f70 -> 1800035b0 code, refcount, length, address, called similarity 0.24
SrvFreeSecret 18000a488 -> 180009b34 code, length, address, called similarity 0.68
SrvAddSecretToList 18000cf64 -> 18000c524 code, length, sig, address similarity 0.34
SrvRemoveSecretFromList 18000d658 -> 18000cb60 code, length, sig, address similarity 0.44
SrvCryptEnumKeys 180008b60 -> 1800083b0 code, length, sig, address, called similarity 0.33
SrvCryptLocalFree 180001010 refcount, length, calling, called similarity 0.5
SrvCryptFreeKey 180002470 -> 1800029e0 code, refcount, length, sig, address, called similarity 0.21
SrvCreateContext 180002b40 -> 180003180 length, address, called similarity 1.0
WPP_SF_qi 18000dbac -> 180004d04 code, name, fullname, length, sig, address similarity 0.78
View full diff report View RCA report Download PoC

Known Exploits

Acknowledgments

k0shl of Kunlun Lab

On This Page