CVE-2023-28229 : Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

Products affected by CVE-2023-28229

Microsoft » Windows Server 2008 » Version: N/A Update SP2
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
Matching versions
Microsoft » Windows Server 2012 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2012 » Version: R2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2016 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2019 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2022 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 11 21h2
Versions before (<) 10.0.22000.1817
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 11 22h2
Versions before (<) 10.0.22621.1555
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1607
Versions before (<) 10.0.14393.5850
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1809
Versions before (<) 10.0.17763.4252
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 21h2
Versions before (<) 10.0.19044.2846
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 20h2
Versions before (<) 10.0.19042.2846
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 22h2
Versions before (<) 10.0.19045.2846
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1507
Versions before (<) 10.0.10240.19869
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*
Matching versions

CVE-2023-28229 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

CISA required action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA description:

Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.

Notes:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28229; https://nvd.nist.gov/vuln/detail/CVE-2023-28229

Added on 2023-10-04 Action due date 2023-10-25

Exploit prediction scoring system (EPSS) score for CVE-2023-28229

EPSS FAQ

1.66%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 87 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-28229

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.0	HIGH	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.0	5.9	Microsoft Corporation
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-28229

CWE-591 Sensitive Data Storage in Improperly Locked Memory

The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might cause the memory to be written to swap files on disk by the virtual memory manager. This can make the data more accessible to external actors.

Assigned by: secure@microsoft.com (Secondary)
CWE-662 Improper Synchronization

The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-28229