CVE-2023-36036

What it actually does

This is a local elevation-of-privilege vulnerability in the Windows Cloud Files Mini Filter Driver, the kernel-mode component associated with cloud-backed file placeholders. A low-privileged local attacker can trigger memory corruption in the driver and escalate execution to kernel/SYSTEM-level privileges. Successful exploitation can allow full control of the affected Windows host, including credential access, security tool tampering, persistence installation, and modification or deletion of protected data.

Why it matters to the business

Because exploitation requires only local low-privileged access and has been observed in the wild, this vulnerability materially increases the impact of phishing, malware execution, stolen user credentials, or any initial foothold on a Windows endpoint or server. An attacker who compromises a standard user context can potentially become an administrator, disable defenses, move laterally, access sensitive business data, and disrupt operations. It is listed in CISA KEV with a remediation due date of 2023-12-05, so unpatched systems should be treated as overdue and high priority. The supplied affected-product metadata also references alfio-event/alf.io and a Git commit fix; that appears inconsistent with the Windows kernel driver vulnerability and should be validated in asset and SBOM tooling to avoid remediation gaps or false attribution.

How an attack unfolds

An attacker first obtains the ability to run code as a normal local user, commonly through phishing, malware, abuse of exposed remote access, or compromise of a low-privileged account. The attacker then executes an exploit that interacts with the Windows Cloud Files Mini Filter Driver and triggers the memory-corruption condition in kernel mode. If successful, the exploit gains elevated privileges, typically SYSTEM or equivalent kernel-level control. From there, the attacker can create privileged processes, dump credentials, disable endpoint protections, modify system configuration, install persistence, access protected files, and use the host as a staging point for lateral movement. Public reporting and KEV inclusion indicate active exploitation in the wild, so defenders should assume exploitation may be paired with commodity malware, post-exploitation frameworks, or hands-on-keyboard intrusion activity rather than occurring as a standalone event.

How to fix it

Apply the Microsoft security updates released in November 2023 or any later cumulative update that includes the fix for the Windows Cloud Files Mini Filter Driver across all supported Windows endpoints and servers. Prioritize internet-facing administrative jump hosts, virtual desktop infrastructure, shared workstations, developer workstations, file servers, and systems where standard users can log on interactively. Remove or isolate unsupported Windows versions that cannot receive the patch. Where immediate patching is not possible, reduce exploitability by preventing untrusted local code execution, enforcing application control such as Windows Defender Application Control or AppLocker, restricting local administrator rights, monitoring and blocking suspicious child processes from user-writable locations, and ensuring EDR tamper protection is enabled. Verify the integrity and version of C:\Windows\System32\drivers\cldflt.sys after patching. The provided fixed-version data for alfio-event/alf.io indicates commit d510c22f613bee0a2b7db51eab0f4d520826d8c0; because that package metadata does not align with the Windows driver vulnerability, confirm whether this is a separate SBOM finding before using it as remediation evidence for this issue.

How to confirm the fix worked

Confirm that affected Windows systems have installed the relevant November 2023 or later cumulative security update through Windows Update history, enterprise patch-management reporting, or PowerShell checks such as Get-HotFix and OS build validation. Confirm the Cloud Files Mini Filter Driver file at C:\Windows\System32\drivers\cldflt.sys is present at a Microsoft-patched version appropriate for the OS build. Reboot systems after patching where required, because kernel driver updates may not be fully active until restart. Perform authenticated vulnerability scans or endpoint posture checks to verify the CVE is no longer reported. For SBOM or dependency scanners reporting alfio-event/alf.io, validate whether the finding is actually tied to that project and, if applicable, confirm the repository includes commit d510c22f613bee0a2b7db51eab0f4d520826d8c0 or a later fixed revision.

Typical attack path

1. Gain initial local code execution as a low-privileged Windows user through phishing, malware, stolen credentials, or another vulnerability.
2. Run an elevation-of-privilege exploit targeting the Windows Cloud Files Mini Filter Driver.
3. Trigger the kernel memory-corruption condition through crafted local driver interactions.
4. Obtain SYSTEM-level or kernel-level privileges on the host.
5. Spawn elevated command shells or processes, modify security settings, or inject into privileged processes.
6. Dump credentials, access protected data, install persistence, and attempt lateral movement to additional systems.

How to detect it

There are no universally reliable public indicators that uniquely prove exploitation of this vulnerability, so detection should focus on behavioral evidence of local privilege escalation and post-exploitation. Review Windows Security logs for unusual privilege assignment, new privileged logons, service creation, and process creation around the time a low-privileged user session was active. Useful Windows events include 4688 for process creation, 4672 for special privileges assigned, 4624 for logons, 7045 in the System log for new service installation, 4697 for service installation where enabled, 1102 for audit log clearing, and 4719 for audit policy changes. Sysmon telemetry is especially valuable: Event ID 1 for process creation, Event ID 6 for driver loads, Event ID 7 for image loads, Event ID 10 for process access to LSASS, Event ID 11 for file creation, Event IDs 12/13/14 for registry changes, and Event ID 22 for DNS queries. Hunt for low-integrity or medium-integrity user processes that rapidly lead to SYSTEM processes, unexpected command shells running as SYSTEM, creation of local administrator accounts, scheduled tasks or services created from user-writable paths, credential-dumping behavior, security tooling being stopped or disabled, and unexplained crashes or faulting activity involving cldflt.sys. Also review EDR alerts for kernel exploit behavior, token manipulation, privilege escalation, LSASS access, BYOVD-like activity, or exploit payloads staged in Temp, Downloads, AppData, ProgramData, or other writable directories. Because the vulnerability is known to be actively exploited, any matching behavior on an unpatched host should be investigated as a potential compromise rather than treated only as exposure.

What your security team should do

• Treat unpatched Windows systems as high priority because the vulnerability is in CISA KEV, is overdue relative to the 2023-12-05 remediation deadline, and has active in-the-wild exploitation.
• Patch or isolate affected Windows endpoints and servers immediately, prioritizing systems with interactive logon, high-value users, remote access exposure, or broad network reach.
• Run an enterprise-wide query for Windows hosts missing November 2023 or later cumulative updates and verify cldflt.sys versions after reboot.
• Hunt for recent local privilege-escalation behavior, especially low-privileged user processes spawning SYSTEM-level shells, service creation, credential-dumping tools, EDR tampering, or unusual access to LSASS.
• Ensure endpoint telemetry captures process creation, service creation, driver load events, PowerShell activity, and security control changes.
• Use application control and attack surface reduction rules to block execution from user-writable directories and common malware staging paths.
• Review vulnerability-management records for inconsistent product attribution involving alfio-event/alf.io and confirm whether that is a separate issue or scanner metadata error.
• If suspicious privilege escalation is observed, preserve volatile evidence, isolate the host, collect forensic artifacts, rotate potentially exposed credentials, and investigate lateral movement.