CVE-2023-28252

What it actually does

CVE-2023-28252 is a local elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) kernel driver. A low-privileged attacker who can run code on an affected Windows host can trigger memory corruption in the CLFS driver and execute code in kernel context, resulting in SYSTEM-level privileges. Successful exploitation can provide full local control over the affected endpoint or server, including the ability to disable security controls, access protected data, dump credentials, install persistence, and move laterally.

Why it matters to the business

This vulnerability turns an initial low-privilege foothold into full administrative control of Windows workstations or servers. Because it is listed in CISA KEV, has been exploited in the wild, and is associated with ransomware activity, unpatched systems present elevated risk of ransomware deployment, credential theft, domain compromise, service disruption, and data exposure. The original CISA remediation due date was 2023-05-02, so any remaining exposure should be treated as overdue and high priority.

How an attack unfolds

An attacker first obtains the ability to execute code locally on an affected Windows system, commonly through phishing, stolen credentials, malware, exploitation of another vulnerability, or access to a low-privileged account. The attacker then runs a crafted exploit that abuses memory corruption in the Windows CLFS kernel driver. The exploit interacts with CLFS functionality and triggers the driver flaw to gain code execution in kernel mode. Once the exploit succeeds, the attacker elevates to SYSTEM privileges and can perform post-exploitation actions such as disabling endpoint protection, dumping LSASS credentials, creating privileged accounts, installing services or scheduled tasks for persistence, accessing sensitive files, staging ransomware, and using harvested credentials for lateral movement. Public reporting and KEV status indicate this vulnerability has been actively exploited in real-world attacks, including ransomware-related activity, so exploitation should be considered operationally mature.

How to fix it

Apply the Microsoft security updates released for CVE-2023-28252 to all affected Windows versions, including Windows 10, Windows 11, and supported Windows Server releases. Prioritize internet-facing systems, user workstations, systems used by administrators, domain controllers, virtualization hosts, file servers, and any host with evidence of compromise. Because no per-product fixed build list was provided, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch management tooling to confirm the April 2023 or later cumulative security update applicable to each OS version is installed. If immediate patching is not possible, reduce exposure by restricting interactive logon, removing unnecessary local user access, enforcing least privilege, enabling tamper protection, monitoring for privilege escalation behavior, and isolating high-risk systems until updated. Mitigations do not replace patching because the flaw is in a kernel driver and has been exploited in the wild.

How to confirm the fix worked

Confirm that each affected Windows endpoint and server has installed the Microsoft cumulative security update that includes the April 2023 fix for CVE-2023-28252 or a later superseding update. Validate through centralized patch inventory, Windows Update history, Microsoft Defender Vulnerability Management, WSUS/SCCM/Intune compliance reports, or by checking installed hotfixes and OS build numbers against Microsoft’s Security Update Guide. Perform authenticated vulnerability scans to verify the host is no longer reported as vulnerable. After patching, reboot systems where required and confirm the updated CLFS driver is loaded. For exposure validation, identify systems running affected Windows versions that have not received April 2023 or later security updates, especially systems allowing local interactive users, RDP users, or application execution by non-admin accounts.

Typical attack path

1. Gain initial access to a Windows workstation or server using phishing, malware, stolen credentials, remote service access, or another exploit.
2. Establish local code execution as a standard or otherwise non-administrative user.
3. Transfer or generate an exploit targeting the Windows Common Log File System driver vulnerability.
4. Run the exploit to trigger CLFS kernel memory corruption.
5. Obtain SYSTEM-level privileges on the local host.
6. Disable or tamper with security tooling and logging where possible.
7. Dump credentials, access protected data, or create persistence mechanisms.
8. Use elevated access to move laterally, escalate broader privileges, or deploy ransomware.

How to detect it

To determine whether this vulnerability may already have been exploited, review endpoint telemetry and Windows logs for suspicious local privilege escalation followed by SYSTEM-level activity. Focus on affected Windows hosts that were unpatched after April 2023, especially those with malware detections, suspicious user execution, or unexpected administrative actions. Relevant log sources include EDR process and memory telemetry, Microsoft Defender alerts, Sysmon logs, Windows Security logs, System logs, PowerShell logs, Windows Defender Operational logs, Task Scheduler logs, Service Control Manager events, and authentication logs. Look for a low-privileged user process spawning or shortly preceding SYSTEM-level processes, suspicious execution from user-writable paths, unexpected service creation, scheduled task creation, credential dumping attempts, LSASS access, security product tampering, and lateral movement after the suspected escalation. Kernel exploit activity may not leave a unique Windows event, so correlate process ancestry, privilege changes, exploit binary execution, crashes, and post-exploitation behavior. Search for unusual interactions with CLFS-related files or driver behavior, unexpected crashes involving clfs.sys, and artifacts around the time a user context suddenly performs privileged actions. Since this CVE has been associated with ransomware activity, also hunt for ransomware precursors such as mass file discovery, backup deletion, shadow copy deletion, encryption tooling, domain-wide remote execution, and rapid endpoint protection disablement.

• clfs.sys
• C:\Windows\System32\drivers\clfs.sys
• Event ID 7045
• A service was installed in the system
• Event ID 4697
• A service was installed in the system
• Event ID 4698
• A scheduled task was created
• Event ID 4672
• Special privileges assigned to new logon
• Event ID 4688
• vssadmin.exe Delete Shadows
• wmic.exe shadowcopy delete
• wbadmin.exe delete catalog
• bcdedit.exe /set {default} recoveryenabled No
• bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
• wevtutil.exe cl
• powershell.exe -enc
• powershell.exe -ExecutionPolicy Bypass
• rundll32.exe comsvcs.dll, MiniDump
• procdump.exe -ma lsass.exe
• reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\Lsa
• DisableAntiSpyware
• Set-MpPreference -DisableRealtimeMonitoring $true

What your security team should do

• Treat remaining vulnerable systems as urgent remediation targets because the vulnerability is in CISA KEV, has active exploitation, and is associated with ransomware activity.
• Patch all affected Windows endpoints and servers with the applicable April 2023 or later Microsoft cumulative security update, prioritizing high-value servers and administrator workstations.
• Run an enterprise-wide hunt for vulnerable Windows builds and missing cumulative updates using vulnerability management and endpoint management tooling.
• Hunt for signs of local privilege escalation followed by SYSTEM-level post-exploitation, including suspicious service creation, scheduled tasks, credential dumping, endpoint protection tampering, and unusual child processes spawned under SYSTEM.
• Review systems with pre-patch compromise indicators for broader intrusion activity, credential theft, lateral movement, and ransomware staging.
• Reset or rotate credentials exposed on any host suspected of exploitation, especially local administrator, domain administrator, service account, and cached credentials.
• Restrict local logon and RDP access to only required users and groups, and remove unnecessary local administrator rights.
• Ensure EDR, Microsoft Defender, tamper protection, LSASS protection, and attack surface reduction rules are enabled where operationally feasible.
• Segment and closely monitor high-value Windows servers that cannot be patched immediately.
• Because the CISA due date has passed, report exceptions through formal risk acceptance and track them to closure.