module
Ancillary Function Driver (AFD) for WinSock Elevation of Privilege
| Disclosed |
|---|
| Jan 10, 2023 |
Disclosed
Jan 10, 2023
Description
A vulnerability exists in the Windows Ancillary Function Driver for Winsock
(`afd.sys`) can be leveraged by an attacker to escalate privileges to those of
NT AUTHORITY\SYSTEM. Due to a flaw in `AfdNotifyRemoveIoCompletion`, it is
possible to create an arbitrary kernel Write-Where primitive, which can be used
to manipulate internal I/O ring structures and achieve local privilege
escalation.
This exploit only supports Windows 11 22H2 up to build 22621.963 (patched in
January 2023 updates).
(`afd.sys`) can be leveraged by an attacker to escalate privileges to those of
NT AUTHORITY\SYSTEM. Due to a flaw in `AfdNotifyRemoveIoCompletion`, it is
possible to create an arbitrary kernel Write-Where primitive, which can be used
to manipulate internal I/O ring structures and achieve local privilege
escalation.
This exploit only supports Windows 11 22H2 up to build 22621.963 (patched in
January 2023 updates).
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.