CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability
Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation
Overview
A flaw in the Windows Common Log File System (CLFS) kernel driver allows a local attacker with standard user credentials to escalate privileges on the affected system. By sending crafted input to the driver, an attacker can trigger an out-of-bounds read in kernel memory, which can be used to gain SYSTEM-level access. The vulnerability affects a wide range of Windows releases, from Windows Server 2008 through Windows Server 2022 and Windows 11 version 23H2.
Vulnerability details
The Windows Common Log File System driver is a kernel-mode component that manages structured log files. CWE-125 (Out-of-Bounds Read) describes a condition where a program reads memory beyond the boundary of an allocated buffer. In a kernel driver, this is particularly serious: the driver operates in a privileged memory space, and reading out-of-bounds kernel memory can expose addresses or internal state that would otherwise be inaccessible to user-mode processes. Because the CLFS driver accepts input from user-mode callers, a crafted request can trigger this condition without requiring elevated privileges or any interaction from another user.
An attacker who already holds a low-privileged local account submits crafted input to the CLFS driver, likely a malformed log file or a specially constructed system call. The out-of-bounds read exposes kernel memory contents, which can be used to defeat address-space layout randomization or otherwise manipulate kernel state in a way that achieves privilege escalation to SYSTEM. The preconditions are local access and a standard user account. No network exposure is required, and no other user needs to take any action for the attack to succeed.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor for unexpected processes or threads running under SYSTEM context that originated from a standard user session, particularly where no corresponding privilege-elevation event (such as a UAC prompt or explicit runas action) appears in the Security event log.
- Review Windows Security event log for Event ID 4672 (Special Privileges Assigned to New Logon) occurring for accounts that hold only standard user rights, with no preceding administrative logon or UAC elevation event in the same session.
Remediation
Additional hardening
- Apply the November 2023 Microsoft security updates: Windows 11 22H2/23H2 to build 10.0.22621.2715 or 10.0.22631.2715, Windows Server 2022 to 10.0.20348.2113, and Windows 10 1809/Server 2019 to 10.0.17763.5122. See References for the full version boundary list.
- Restrict local interactive and remote desktop access to only accounts that require it; reducing the number of users who can log in locally limits the pool of potential attackers who meet the low-privileged-account precondition.
- Apply the principle of least privilege across all user accounts and service accounts to reduce the value of any single compromised session and limit lateral movement following a successful escalation.
- Where possible, use Windows Defender Credential Guard and kernel-integrity features such as Hypervisor-Protected Code Integrity (HVCI) to raise the bar for kernel memory manipulation after an out-of-bounds read.
Key dates
References
Frequently asked questions
Does CVE-2023-36424 affect my FedRAMP authorization?
If Microsoft Windows runs inside your authorization boundary, CVE-2023-36424 affects your FedRAMP authorization directly. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of April 27, 2026 has already passed. An unpatched KEV inside your boundary is an assessor finding. An overdue one is visible to your assessor and sponsoring agency right now. Your path forward is either remediation or formal documentation of the mitigation and the delay.
How does Knox help me handle CVE-2023-36424?
Knox does not patch Microsoft Windows on your behalf. Under the FedRAMP shared-responsibility model, remediating this vulnerability is your obligation. What Knox provides is the pre-authorized, single-tenant boundary in which you carry out that remediation, along with Knox's automated continuous monitoring platform and audit-artifact coverage that support documentation of the fix ahead of your next assessment. The remediation work is yours to execute; maintaining a compliant posture while you do it is not something you manage without support.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance gaps, including issues like CVE-2023-36424. Exposure surfaces during ongoing monitoring rather than waiting until an assessor flags it at review time, giving your team the opportunity to act before a finding becomes a formal problem.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2023-36424's remediation deadline of April 27, 2026 has passed. What happens now?
If CVE-2023-36424 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out now and documenting the circumstances of the delay is what keeps your authorization intact and the agency relationship in good standing.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
