A public exploit for CVE-2023-21768 shows that a local attacker can reach SYSTEM privileges through the Windows Ancillary Function Driver for WinSock. The code targets vulnerable Windows 11 22H2 systems, and the flaw was already patched in January 2023 rather than newly disclosed.
How the flaw was identified
Valentina Palmiotti, known as chompie, and Ruben Boonen published the code. IBM published their technical analysis on March 21, 2023. The issue carries a CVSS score of 7.8 and needs low-level local privileges, with no user interaction. It does not give an attacker a direct way in over the internet.
The vulnerability sits in afd.sys, the Windows kernel driver that handles requests from the WinSock networking interface. IBM said the researchers compared the December 2022 and January 2023 driver versions to understand Microsoft’s fix. Only one function, AfdNotifyRemoveIoCompletion, appeared to change, which narrowed the investigation.
What the old code allowed
The earlier code failed to check a memory pointer supplied by a user application. That gap let a local attacker write to kernel memory, where Windows keeps sensitive system data. Microsoft’s updated code added validation so pointers from user mode must reference suitable user-space memory instead of protected kernel addresses.
The researchers said they diagnosed the issue, reproduced it, and turned it into a working exploit in about one day, despite having no previous experience with this driver. Their work shows how comparing patched and unpatched software can reveal enough detail to build an attack quickly.
Exploit behavior and limits
The public GitHub repository describes the code as a demonstration. Its full privilege-escalation chain works on vulnerable Windows 11 22H2 installations, while the underlying memory-write capability works across vulnerable systems. Those are separate claims, and the repository does not promise full exploit compatibility with every affected Windows version.
To move from a limited memory write to broader control, the exploit changes Windows I/O ring objects. These objects support queued input and output work. The technique builds on research by Yarden Shafir and enables kernel memory reads and writes. The exploit then replaces a target process’s security token with one carrying SYSTEM privileges.
Related exploit reports
IBM said 360 IceSword Lab found a different exploit in the wild in January 2023. That sample used the ProcessSocketNotifications interface rather than the researchers’ direct driver approach. The report does not establish that attackers used the published GitHub code.
Administrators should verify that affected devices received Microsoft’s fix or later applicable updates. IBM’s demonstration also worked without being blocked by HVCI, which shows that this protection should not replace patching.
Related coverage includes CVE-2024-38193 exploitation and the CVE-2025-32709 WinSock zero-day. Both involve the same driver, but they are separate flaws with different causes and patches.
Keywords
CVE-2023-21768, Windows Ancillary Function Driver for WinSock, SYSTEM privileges, Windows 11 22H2, afd.sys
Licensed under CC BY-ND 4.0 International