Attacker Value
Very High
(1 user assessed)
Exploitability
Unknown
(1 user assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
3

CVE-2023-28252

Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Privilege Escalation
Techniques
Validation
Validated

Description

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Add Assessment

3
Ratings
Technical Analysis

This was discovered because of zero-day exploitation perpetrated by a skilled adversary — final payload was Nokoyawa ransomware in at least one case, as Kaspersky details here. We’ve seen a sustained burst of driver exploitation by a range of threat actors the past two years. The trend continues.

Patched in April 2023 Patch Tuesday, so grab those updates quickly as always!

General Information

Vendors

  • Microsoft

Products

  • Windows 10 Version 1809,
  • Windows Server 2019,
  • Windows Server 2019 (Server Core installation),
  • Windows Server 2022,
  • Windows 10 Version 20H2,
  • Windows 11 version 21H2,
  • Windows 10 Version 21H2,
  • Windows 11 version 22H2,
  • Windows 10 Version 22H2,
  • Windows 10 Version 1507,
  • Windows 10 Version 1607,
  • Windows Server 2016,
  • Windows Server 2016 (Server Core installation),
  • Windows Server 2008 Service Pack 2,
  • Windows Server 2008 Service Pack 2 (Server Core installation),
  • Windows Server 2008 Service Pack 2,
  • Windows Server 2008 R2 Service Pack 1,
  • Windows Server 2008 R2 Service Pack 1 (Server Core installation),
  • Windows Server 2012,
  • Windows Server 2012 (Server Core installation),
  • Windows Server 2012 R2,
  • Windows Server 2012 R2 (Server Core installation)

Additional Info

Technical Analysis