POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability

A public proof-of-concept exploit for CVE-2023-21768 shows how attackers with local access can gain SYSTEM privileges through the Windows Ancillary Function Driver for WinSock.

Researchers Valentina Palmiotti, known as chompie, and Ruben Boonen published the code. Their complete exploit targets vulnerable Windows 11 22H2 systems.

The release concerns a vulnerability patched in January 2023, not a newly disclosed Windows flaw. IBM published the researchers’ technical analysis on March 21, 2023.

The vulnerability carries a CVSS score of 7.8 and requires low-level local privileges, with no user interaction. It does not provide a direct route into a computer over the internet. The flaw sits in afd.sys, a Windows kernel driver that handles requests from the WinSock networking interface.

According to IBM’s technical analysis, the researchers compared driver versions from December 2022 and January 2023 to understand Microsoft’s fix. Only one function, AfdNotifyRemoveIoCompletion, appeared to have changed, helping them narrow their investigation.

The older code failed to check a memory pointer supplied from a user application. That missing check let a local attacker write to kernel memory, where Windows stores sensitive system data.

Microsoft’s updated code added validation to ensure that pointers from user mode reference suitable user-space memory rather than protected kernel addresses.

POC for Windows WinSock Ancillary Vulnerability

The researchers said they diagnosed, reproduced, and turned the flaw into a working exploit in about one day, despite having no previous experience with this driver.

Their findings show how comparing patched and unpatched software can reveal enough detail to build an attack quickly.

The public GitHub repository describes the code as a demonstration. Its complete privilege escalation chain works on vulnerable Windows 11 22H2 installations, while the underlying memory-write capability works across vulnerable systems.

These are separate claims, and the repository does not promise full exploit compatibility with every affected Windows version. To move from a limited memory write to broader control, the exploit changes Windows I/O ring objects. These objects support queued input and output work.

The technique builds on research by Yarden Shafir and enables kernel memory reads and writes. The exploit then replaces a target process’s security token with one carrying SYSTEM privileges.

IBM also reported that 360 IceSword Lab found a different exploit in the wild in January 2023. That sample used the ProcessSocketNotifications interface rather than the researchers’ direct driver approach. This report does not establish that attackers used the published GitHub code.

Administrators should verify that affected devices received Microsoft’s fix or later applicable updates. IBM’s demonstration also worked without being blocked by HVCI, showing why that protection should not replace patching.

Related coverage includes CVE-2024-38193 exploitation and the CVE-2025-32709 WinSock zero-day. Both involve the same driver, but are separate flaws with different causes and patches.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability appeared first on Cyber Security News.