Ransomwarecritical
Windows CLFS and five exploits used by ransomware operators (Exploit #4 – CVE-2023
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-36955 | Local Privilege Escalation in Microsoft Windows CLFS Driver | 7.8 | 4% | KEVRansomware | KEV |
CVE-2021-36963+1 related CVE | Windows Common Log File System Driver Elevation of Privilege Vulnerability | 7.8 | 1% | ||
| CVE-2022-24521 | Out-of-bounds Write Privilege Escalation in Microsoft Windows CLFS Driver | 7.8 | 7% | KEVRansomware | KEV |
| CVE-2023-23376 | Out-of-Bounds Write Privilege Escalation in Microsoft Windows CLFS Driver | 7.8 | 11% | KEVRansomware | KEV |
| CVE-2023-28252 | Heap Overflow in Microsoft Windows CLFS Driver Enables Local Privilege Escalation | 7.8 | 49% | KEVRansomwarePoC | KEV |
From the original article
5 min read at securelist.com
This is part five of our study about the Common Log File System (CLFS) and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you haven’t already. You can skip to the other parts using this table of contents or using the link at the end of this part.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.