CVE-2023-21768Disclosure(microsoft / windows_11)

CVE-2023-21768 is an interesting Windows kernel vulnerability to study. The bug resided in afd.sys, the Windows Ancillary Function Driver that implements the kernel-side of WinSock. Insufficient validation of a user-supplied pointer in an IOCTL path allowed attackers to build an arbitrary kernel write primitive and elevate privileges to NT AUTHORITY\SYSTEM. It's a solid case study in IOCTL handling, user/kernel boundary validation, and secure kernel programming.

One of the most fascinating Windows kernel bugs is CVE-2023-21768 - https://www.sentinelone.com/blog/cve-2023-21768/ A simple integer overflow in the Common Log File System (CLFS) driver causes the kernel to allocate less memory than required but continue writing as if the buffer was large enough. The resulting out-of-bounds write corrupts adjacent kernel objects, giving attackers arbitrary kernel read/write and eventually SYSTEM privileges.