CVE-2023-28252 is a high-severity elevation of privilege vulnerability affecting the Windows Common Log File System Driver on various versions of Microsoft Windows, including Windows 10, Windows 11, and Windows Server. This vulnerability allows attackers to escalate their privileges on affected systems, potentially gaining SYSTEM-level access. It has been publicly disclosed and exploited, making it crucial for users to apply security updates to protect their systems. The vulnerability is easy to understand, even for those not well-versed in technical language.

How do I know if I'm affected?

To determine if you're affected by this vulnerability, you should check if you're using any of the impacted versions of Microsoft Windows, including Windows 10, Windows 11, Windows Server 2008, Windows Server 2012, Windows Server 2016, Windows Server 2019, and Windows Server 2022. This vulnerability is an elevation of privilege issue in the Windows Common Log File System Driver, which could allow attackers to gain higher privileges on your system. Keep in mind that this vulnerability has been publicly disclosed and exploited, so it's essential to stay informed and apply security updates when available.

What should I do if I'm affected?

If you're affected by this vulnerability, it's important to apply security updates provided by Microsoft. To do this, go to your Windows settings, click on "Update & Security," and then select "Check for updates." Install any available updates to protect your system from potential attacks.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability, named Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability, was added on April 11, 2023, with a due date of May 2, 2023. The required action is to apply updates per vendor instructions to address this elevation of privilege issue, which could allow attackers to gain SYSTEM privileges on affected systems.

Weakness enumeration

The weakness enumeration for this vulnerability is "Insufficient Information", indicating a lack of specific details about the vulnerability and its mitigation.

For more details

CVE-2023-28252 is a high-severity vulnerability affecting the Windows Common Log File System Driver, with potential for attackers to escalate privileges on impacted systems. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and affected software configurations, refer to the NVD page or the links below.

• Windows Common Log File System Driver (clfs.sys) Privilege Escalation ≈ Packet Storm

• Security Update Guide - Microsoft - Windows Common Log File System Driver Elevation of Privilege Vulnerability