CVE-2023-36802

What it actually does

This is a local elevation-of-privilege vulnerability in Microsoft Streaming Service Proxy caused by a use-after-free condition. A low-privileged attacker who can execute code on an affected Windows system can trigger unsafe memory reuse in the vulnerable component and potentially manipulate kernel memory to gain high-integrity or SYSTEM-level privileges. The vulnerability does not provide initial remote access by itself, but it is valuable after compromise because it can turn a limited foothold into full host control.

Why it matters to the business

Successful exploitation can allow an intruder who already has limited access to take full control of affected Windows endpoints or servers, disable security tools, access sensitive data, move laterally, and deploy additional malware. The vulnerability is listed in CISA KEV with active exploitation in the wild and a remediation due date of 2023-10-03, so unpatched systems should be treated as high-priority exposure even though the CVSS score is 7.8. The provided product metadata also references rubygems/rubygems.org GIT with a fixed commit; organizations using that listed artifact should validate they are at or beyond the fixed revision.

How an attack unfolds

An attacker first obtains local code execution through another vector such as phishing, stolen credentials, malware, or exploitation of a separate vulnerability. From that low-privileged context, the attacker runs an exploit that interacts with the Microsoft Streaming Service Proxy component and triggers the use-after-free condition. By carefully shaping memory allocations, the exploit attempts to corrupt kernel memory or replace security-relevant process token data. If successful, the attacker launches a process with elevated privileges, commonly NT AUTHORITY\SYSTEM, and then uses that access to dump credentials, tamper with endpoint defenses, persist, or move laterally. Because this vulnerability is in the KEV catalog and marked as actively exploited, defenders should assume public or private exploit code has been operationalized.

How to fix it

Apply the relevant Microsoft security updates that address CVE-2023-36802 on all affected Windows systems, prioritizing internet-facing administration hosts, servers, shared workstations, VDI images, and systems where users can execute untrusted code. Because this issue is in CISA KEV, remediation should be treated as urgent and already overdue relative to the 2023-10-03 due date. Where immediate patching is not possible, reduce exposure by limiting local interactive access, enforcing least privilege, blocking untrusted executable content, hardening application control, and increasing monitoring for local privilege escalation behavior. For the listed rubygems/rubygems.org GIT artifact, ensure deployments include fixed commit 0b3272ac17b45748ee0d1867c49867c7deb26565 or a later trusted revision, and verify whether that package entry is applicable to the environment because the vulnerability description is Microsoft Windows-specific.

How to confirm the fix worked

Confirm affected Windows systems have the Microsoft security update level that includes the September 2023 fix or later cumulative updates. Validate by checking OS build and installed hotfix history through standard patch-management tooling, Windows Update inventory, or endpoint management records. On systems built from golden images, confirm the base image was updated and redeployed rather than only patching running instances. Where the listed GIT package is relevant, verify the deployed source revision is 0b3272ac17b45748ee0d1867c49867c7deb26565 or later. As a functional exposure check, review whether vulnerable systems still have outdated Microsoft Streaming Service Proxy driver binaries and whether low-privileged users can execute arbitrary local binaries. Do not rely on exploit testing in production; use patch inventory and binary/version validation instead.

Typical attack path

1. Gain initial local code execution on an affected Windows host using phishing, malware, stolen credentials, or another vulnerability.
2. Run a local privilege-escalation exploit from the compromised low-privileged account.
3. Trigger the Microsoft Streaming Service Proxy use-after-free condition through crafted local interactions with the vulnerable component.
4. Manipulate kernel memory or process token state to obtain elevated privileges.
5. Spawn an elevated process such as a SYSTEM command shell, service, scheduled task, or payload.
6. Use elevated access to disable defenses, harvest credentials, establish persistence, or pivot to additional systems.

How to detect it

This vulnerability is a local privilege-escalation issue, so exploitation may not create distinctive network indicators. Focus detection on endpoint telemetry before and after suspicious privilege changes. Review Windows Security logs for process creation, special privilege assignment, new service installation, scheduled task creation, and logon activity where a standard user context is followed by SYSTEM-level execution. Review Sysmon or EDR telemetry for unknown binaries launched from user-writable directories that create elevated child processes, modify services, dump credentials, disable security tools, or interact with kernel/driver interfaces. Examine Windows Error Reporting, System logs, and EDR crash telemetry for crashes or abnormal behavior involving the Microsoft Streaming Service Proxy driver. Pay particular attention to chains where initial malware or remote-access tooling is followed by rapid local privilege escalation. Because no stable public exploit-specific file name, hash, or command line is inherent to the vulnerability, behavioral correlation is more reliable than static IOC matching.

• MSKSSRV.sys
• C:\Windows\System32\drivers\MSKSSRV.sys
• Microsoft Streaming Service Proxy
• NT AUTHORITY\SYSTEM
• whoami /priv
• whoami /all
• cmd.exe /c whoami
• powershell.exe -Command whoami
• sc.exe create
• schtasks.exe /Create
• Event ID 4688
• Event ID 4672
• Event ID 7045
• Sysmon Event ID 1
• Sysmon Event ID 6
• 0b3272ac17b45748ee0d1867c49867c7deb26565

What your security team should do

• Treat this as an urgent KEV remediation item and prioritize patching all affected Windows systems that permit local user logon or arbitrary code execution.
• Hunt for signs of recent local privilege escalation, especially low-privileged user processes spawning SYSTEM-level shells, services, scheduled tasks, or security-tool tampering shortly after initial access.
• Correlate endpoint detections with Windows Security events, Sysmon process creation, service creation, driver-load telemetry, EDR privilege-escalation alerts, and crash logs involving the Microsoft Streaming Service Proxy driver.
• Restrict local administrator pathways and enforce least privilege so successful exploitation yields less operational advantage.
• Use application control or EDR prevention policies to block unknown local exploit binaries from user-writable paths such as Downloads, Temp, and AppData.
• Verify patch compliance against the KEV due date and track exceptions with compensating controls and expiration dates.
• If the listed rubygems/rubygems.org GIT artifact is in use, validate it is updated to commit 0b3272ac17b45748ee0d1867c49867c7deb26565 or later and confirm the package mapping is accurate.