As part of the January 2023 updates, Microsoft has released updates that fix 98 security vulnerabilities, including a 0-day vulnerability, Windows ALPC.
The details of the detected 0-day security vulnerability are as follows;
- The vulnerability tracked as CVE-2023-21674 is a critical Privilege Escalation vulnerability that affects Windows’s ALPC (Advanced Local Procedure Call) component. The vulnerability due to the boundary fault could allow threat actors to execute code with SYSTEM privileges on the affected system. Advanced Local Procedure Call is a message-forwarding mechanism used in Windows systems.
It is known that threat actors actively exploit this vulnerability. Microsoft has released security updates that fix other vulnerabilities, including this one. In this context, it is recommended to immediately apply the published updates to vulnerable products and versions in order not to be the target of attacks that can be carried out using vulnerabilities.
What do the official records say about CVE-2023-21674?
The U.S. National Vulnerability Database lists CVE-2023-21674 as a Windows Advanced Local Procedure Call (ALPC) elevation of privilege vulnerability. It was published on 10 January 2023, the day of Microsoft’s January Patch Tuesday. The CVSS 3.1 base score is 8.8, which is High. The vector is local: the attacker must already be able to run code on the machine. The weakness is classed as CWE-416, a use after free error. The post above describes it as a boundary fault; the NVD record uses the CWE-416 label.
A local flaw sounds less serious than a remote one. In practice it is not. Attackers often chain a local privilege flaw with a first foothold, such as a malicious document or a browser exploit. The first step gives them a low-privilege shell. The second step, here CVE-2023-21674, lifts that shell to SYSTEM, the highest level on a Windows machine. With SYSTEM rights an attacker can turn off security tools, read most data and move on to other machines.
Why did CISA add it to its exploited list?
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2023-21674 to its Known Exploited Vulnerabilities Catalog on 10 January 2023. The catalog lists flaws that attackers are known to use. US federal agencies had to apply the fix by 31 January 2023, and the required action is to apply updates per vendor instructions. Private companies are not bound by that deadline, but it is a useful guide to how urgent the fix is.
What should you do?
- Install the January 2023 Windows security updates on all workstations and servers. Start with machines that many people use, such as terminal servers and jump hosts.
- Use the Microsoft Security Response Center entry to find the right update for each Windows version.
- Reduce the chance of a first foothold. Keep browsers and office software current and limit which users have local admin rights.
- Watch cyber threat intelligence reports for new activity that uses this flaw, and keep an inventory of exposed systems with external attack surface management.
Sources: NVD record for CVE-2023-21674, CISA Known Exploited Vulnerabilities Catalog and Microsoft Security Response Center.