A public proof-of-concept exploit for CVE-2023-21768 demonstrates how attackers with local access can elevate privileges through the Windows Ancillary Function Driver for Winsock. Researchers Valentina Palmiotti, known as chompie, and Ruben Boonen released the code. According to IBM’s technical analysis, the researchers compared driver versions from December 2022 and January 2023 to understand Microsoft’s fix.
The older code failed to validate a memory pointer from a user application, allowing a local attacker to write to kernel memory, where Windows stores sensitive system data. Microsoft’s updated code added validation to ensure that pointers from user mode reference suitable user-space memory, rather than protected kernel addresses. Researchers were able to diagnose, reproduce, and turn the flaw into a working exploit in just one day, despite having no previous experience with this driver.
Their findings highlight how comparing patched and unpatched software can reveal enough detail to quickly build an attack. It successfully executes a complete privilege escalation chain on vulnerable Windows 11 22H2 systems, while its underlying memory-write capability applies to various vulnerable machines. To achieve broader control, the exploit alters Windows I/O ring objects, which support queued input and output operations.
This sample utilized the ProcessSocketNotifications interface instead of the researchers' direct driver approach.
