CVE-2023-36425HighCVSS 8.0

Windows Distributed File System (DFS) Remote Code Execution Vulnerability

Published
November 14, 2023
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2023-36425 →

📋 Description

According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires the attacker or targeted user to have both domain user and delegate management permissions on a non-default DFS namespace.

How could an attacker exploit this vulnerability? An attacker could exploit a DFS namespace (non-default) out-of-bound write vulnerability that results in heap corruption, which could then be used to perform arbitrary code execution on the server's dfssvc.exe process which runs as SYSTEM user.

According to the CVSS metric, attack complexity is high (AC:H). What does that mean for this vulnerability? In a real-world attack scenario, a domain admin would have to configure their DFS namespace in such a way to add a low privileged domain user to the delegate management permission on a certain DFS namespace. In essence, a successful exploitation of this vulnerability would require a non-default and unlikely configuration.

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability? An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.

🎯 Affected products36

  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 11 Version 23H2 for ARM64-based Systems
  • Windows 11 Version 23H2 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • +6 more not shown

✅ Remediation

KB5032196 (Security Update) — fixed build 10.0.17763.5122 KB5032198 (Security Update) — fixed build 10.0.20348.2113 KB5032304 (SecurityHotpatchUpdate) — fixed build 10.0.20348.2091 KB5032192 (Security Update) — fixed build 10.0.22000.2600 KB5032189 (Security Update) — fixed build 10.0.19043.3693 KB5032190 (Security Update) — fixed build 10.0.22621.2715 KB5032189 (Security Update) — fixed build 10.0.19045.3693 KB5032190 (Security Update) — fixed build 10.0.22631.2715 KB5032202 (Security Update) — fixed build 10.0.25398.531 KB5032199 (Security Update) — fixed build 10.0.10240.20308 KB5032197 (Security Update) — fixed build 10.0.14393.6452 KB5032254 (Monthly Rollup) — fixed build 6.0.6003.22367 KB5032248 (Security Only) — fixed build 6.0.6003.22367 KB5032252 (Monthly Rollup) — fixed build 6.1.7601.26816 KB5032250 (Security Only) — fixed build 6.1.7601.26816 KB5032247 (Monthly Rollup) — fixed build 6.2.9200.24569 KB5032249 (Monthly Rollup) — fixed build 6.3.9600.21668

🔗 References (31)