CVE-2023-28229
published 2023-04-11CVE-2023-28229: Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
PriorityP180high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2023-10-25
Exploited in the wild
EPSS
1.87%
77.2th percentile
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Affected
41 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.19869 | 10.0.10240.19869 |
| microsoft | windows_10_1607 | < 10.0.14393.5850 | 10.0.14393.5850 |
| microsoft | windows_10_1809 | < 10.0.17763.4252 | 10.0.17763.4252 |
| microsoft | windows_10_20h2 | < 10.0.19042.2846 | 10.0.19042.2846 |
| microsoft | windows_10_21h2 | < 10.0.19044.2846 | 10.0.19044.2846 |
| microsoft | windows_10_22h2 | < 10.0.19045.2846 | 10.0.19045.2846 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19869 | 10.0.10240.19869 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5850 | 10.0.14393.5850 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.4252 | 10.0.17763.4252 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.4252 | 10.0.17763.4252 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.2846 | 10.0.19042.2846 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.2846 | 10.0.19044.2846 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.2846 | 10.0.19045.2846 |
| microsoft | windows_11_21h2 | < 10.0.22000.1817 | 10.0.22000.1817 |
| microsoft | windows_11_22h2 | < 10.0.22621.1555 | 10.0.22621.1555 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.1817 | 10.0.22000.1817 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.1555 | 10.0.22621.1555 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.26466 | 6.1.7601.26466 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.22015 | 6.0.6003.22015 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.24216 | 6.2.9200.24216 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20919 | 6.3.9600.20919 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.5850 | 10.0.14393.5850 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.4252 | 10.0.17763.4252 |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability requires winning a race condition to exploit — detection should focus on unusual repeated or concurrent access patterns to the Windows CNG Key Isolation Service (KeyIso) ↗
- →Monitor for unexpected or limited SYSTEM-level privilege escalation originating from the CNG Key Isolation Service (lsass.exe / KeyIso service context) ↗
- →Track exploitation attempts against the Windows CNG Key Isolation Service as a known exploited vulnerability per CISA KEV; prioritize alerting on privilege escalation events tied to this service ↗
- ·Exploit status at time of MSRC advisory was 'Publicly Disclosed: No; Exploited: No; Exploitation Less Likely' — however CISA subsequently added it to the KEV catalog, indicating confirmed in-the-wild exploitation ↗
- ·Attack complexity is rated High (AC:H) due to the race condition requirement, meaning exploitation is not trivially repeatable but is still feasible ↗
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck7.0HIGH
cisa7.0HIGH
vendor_msrc7.0HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
cisa·2023-10-04·CVSS 7.0
CVE-2023-28229 [HIGH] CWE-591 Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
Vulnerability: Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
Affected: Microsoft Windows CNG Key Isolation Service
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28229; https://nvd.nist.gov/vuln/detail/CVE-2023-28229
Remediation Due Date: 2023-10-25
Microsoft
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
vendor_msrc·2023-04-11·CVSS 7.0
CVE-2023-28229 [HIGH] CWE-591 Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain specific limited SYSTEM privileges.
Windows CNG Key Isolation Service: Windows CNG Key Isolation Service
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7
GHSA
GHSA-62cg-xhwr-xf37: Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
ghsa_unreviewed·2023-04-11
CVE-2023-28229 [HIGH] CWE-591 GHSA-62cg-xhwr-xf37: Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
VulnCheck
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
vulncheck·2023·CVSS 7.0
CVE-2023-28229 [HIGH] CWE-591 Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.
Affected: Microsoft Windows
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/389ef9618afd; https://vulncheck.com/xdb/2a3dcdd65fe2
Remediation Due: 2023-10-25
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-04-11
Published
2023-10-04
Added to CISA KEV
Exploited in the wild