A public proof-of-concept exploit for CVE-2023-21768 shows how a local attacker can reach SYSTEM privileges through the Windows Ancillary Function Driver for WinSock. Valentina Palmiotti, known as chompie, and Ruben Boonen published the code, and their full exploit targets vulnerable Windows 11 22H2 systems.
How the flaw was studied
IBM published the researchers’ technical analysis on March 21, 2023. The issue had already been patched in January 2023, so the release is about an older vulnerability rather than a newly disclosed Windows flaw. The weakness carries a CVSS score of 7.8 and needs low-level local privileges, with no user interaction. It does not give a direct internet-based route into a machine.
The flaw lives in afd.sys, a Windows kernel driver that handles requests from the WinSock networking interface. IBM said the researchers compared driver versions from December 2022 and January 2023 to understand Microsoft’s fix. Only one function, AfdNotifyRemoveIoCompletion, appeared to change, which narrowed the investigation.
How the exploit reaches SYSTEM
The older code failed to check a memory pointer supplied from a user application. That gap let a local attacker write to kernel memory, where Windows keeps sensitive system data. Microsoft’s updated code added validation so pointers from user mode must reference suitable user-space memory instead of protected kernel addresses.
The researchers said they diagnosed, reproduced, and turned the flaw into a working exploit in about one day, despite having no prior experience with this driver. Their work shows that comparing patched and unpatched software can reveal enough detail to build an attack quickly. The public GitHub repository describes the code as a demonstration, and its complete privilege-escalation chain works on vulnerable Windows 11 22H2 installations, while the underlying memory-write capability works across vulnerable systems.
The repository does not promise full exploit compatibility with every affected Windows version. To move from the limited memory write to broader control, the exploit changes Windows I/O ring objects, which support queued input and output work. The technique builds on research by Yarden Shafir and enables kernel memory reads and writes. The exploit then replaces a target process’s security token with one that carries SYSTEM privileges.
Related exploit activity and defenses
IBM also reported that 360 IceSword Lab found a different exploit in the wild in January 2023. That sample used the ProcessSocketNotifications interface rather than the researchers’ direct driver approach. This report does not establish that attackers used the published GitHub code.
Administrators should verify that affected devices received Microsoft’s fix or later applicable updates. IBM’s demonstration also worked without being blocked by HVCI, so that protection should not replace patching. Related coverage includes CVE-2024-38193 exploitation and the CVE-2025-32709 WinSock zero-day, and both involve the same driver but separate flaws with different causes and patches.
Keywords
Windows Ancillary Function Driver for WinSock, proof-of-concept exploit, local privilege escalation, Windows 11 22H2, I/O ring objects
Licensed under CC BY-ND 4.0 International