CVE 2023 29336 - Exploit on Windows Server 2016 - Win32k Privilege Escalation Vulnerability

Elevation of Privilege Vulnerability in Win32k Exploited in the Wild (CVE-2023-29336)
Description: Microsoft CVE-2023-29336 - Win32k Elevation of Privilege Vulnerability
CVE ID: CVE-2023-29336
Threat/Vulnerability: Elevation of Privilege
#What is Win32k?
Win32k is a system component in Microsoft Windows OS that controls graphic and UI functions at the kernel level.
Win32k is responsible for rendering fonts, icons, buttons, and other graphical elements in Windows.
It is integral to the OS and any issues affecting Win32k may cause system instability or crashes.
#What is the Attack?
An Elevation of Privilege (EoP) vulnerability exists in Win32K kernel that allows an attacker to obtain SYSTEM privileges.
The issue has been assigned CVE-2023-29336. No further details are available from Microsoft.
The vulnerability has a CVSS base score of 7.8 and is rated HIGH.
#Why is this Significant?
This is significant because attackers have reportedly started to exploit CVE-2023-29336 in real-time attacks.
CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on May 9th, 2023. As such, patches should be applied as soon as possible.
#What is the Vendor Solution?
Microsoft issued a patch for this on May 9th, 2023.
Method 1: Windows Update
This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see Windows Update: FAQ.
Method 2: Microsoft Update Catalog
To get the stand-alone package for this update, go to the Microsoft Update Catalog website: catalog.update....
References:
msrc.microsoft...
www.cisa.gov/k...
www.fortiguard...
PoC: github.com/num...

[@ВиталийОвчаренко-и1н]

The process for resolving issues and making decisions related to CVE-2023-29336 involves the CVE Assignment Team and CNAs. The CVE ID was assigned by Microsoft Corporation, the CNA responsible for this vulnerability. The process includes using a policy known as the Counting Process and an inclusion decision tree to determine if the vulnerability should be included in the CVE list and if multiple CVE IDs need to be assigned. Once a reporter requests a CVE ID, the CNA evaluates the vulnerability, assigns a CVE ID, provides a brief description, and includes references before posting the new CVE on the CVE website.