Cybercrime group exploits Windows zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-28252 | Heap Overflow in Microsoft Windows CLFS Driver Enables Local Privilege Escalation CVE-2023-28252 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Common Log File System (CLFS) driver that allows privilege escalation. The flaw is triggered when the kernel's CLFS driver processes malformed or maliciously crafted log file data, corrupting heap memory; an attacker who can already run code on a target system (e.g., a low-privileged user or an attacker chained with another flaw such as a remote code execution bug) can leverage it to gain SYSTEM-level privileges. Because the CLFS driver ships with supported Windows client and server releases, essentially the entire Windows installed base is potentially exposed. The vulnerability is being actively exploited: CISA added it to the KEV catalog on 2023-04-11 with known ransomware use, and EPSS estimates a 49.0% probability of exploitation within 30 days (99th percentile). It was addressed in Microsoft's April 2023 security updates, and the required remediation action is to apply the vendor updates. Do: Apply Microsoft's April 2023 (or later) cumulative security updates to all Windows clients and servers per vendor instructions, prioritizing high-value and domain infrastructure systems given the known ransomware use; there is no public PoC or known workaround, so patching is the primary mitigation. Note that this is a local elevation-of-privilege flaw, so also hunt for prior low-privilege access or exploitation chains on hosts, and confirm remediation by checking installed update levels across the estate. | 7.8 | 49% | KEV ransomware PoC |
| masshundreds of millions of Windows devices (the CLFS driver is present across essentially all modern Windows 10/11 and Windows Server installations) |
Full article457 words · extracted from securityaffairs.com · click to collapse
Microsoft has addressed a zero-day in the Windows Common Log File System (CLFS) actively exploited in ransomware attacks.
Microsoft has addressed a zero-day vulnerability, tracked as CVE-2023-28252, in the Windows Common Log File System (CLFS), which is actively exploited in ransomware attacks. Microsoft fixed the issue with the release of Patch Tuesday security updates for April 2023.
The issue is an unspecified vulnerability in the CLFS driver that allows for privilege escalation. A local attacker can exploit this vulnerability to gain SYSTEM privileges. The vulnerability is easy to exploit and could be triggered without user interaction.
US CISA has added the flaw to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are exploiting the flaw to escalate privileges and deploy Nokoyawa ransomware.
CISA orders federal agencies to fix this vulnerability by May 2nd, 2023.
Kaspersky Lab experts first reported that the CVE-2023-28252 flaw was exploited in attacks deploying the Nokoyawa ransomware.
On February 2023, Kaspersky experts observed a number of attempts to execute elevation-of-privilege exploits on Microsoft Windows servers belonging to small and medium-sized businesses in the Middle East, in North America, and previously in Asia regions.
The experts pointed out that while the majority of zero-days they have discovered in the past were used by APT groups, this zero-day was exploited by a sophisticated cybercrime group. This group is known to have used similar CLFS driver exploits in the past that were likely developed by the same author.
“The discovered exploit uses the vulnerability to corrupt another specially crafted base log file object in a way that a fake element of the base log file gets treated as a real one.” reads the analysis published by Kaspersky.
The experts will not share any additional details about the vulnerability and the exploit used by the threat actors to avoid other groups of attackers can use it.
“We see a significantly increasing level of sophistication among cybercriminal groups. We don’t often see APTs using zero-day exploits in their attacks, and now there are financially motivated cybercriminal groups that have the resources to acquire exploits for unknown vulnerabilities and routinely use them in attacks.” concludes the report. “Moreover, there are developers willing to help cybercriminal groups and to produce one exploit after another.”
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:
- The Teacher – Most Educational Blog
- The Entertainer – Most Entertaining Blog
- The Tech Whizz – Best Technical Blog
- Best Social Media Account to Follow (@securityaffairs)
Please nominate Security Affairs as your favorite blog.
Nominate here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, zero-day)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/144692/hacking/windows-zero-day-ransomware-attacks.html