A public proof-of-concept exploit for CVE-2023-21768 demonstrates how an attacker with local access can escalate to SYSTEM privileges via the Windows Ancillary Function Driver for WinSock.
Security researchers Valentina Palmiotti (chompie) and Ruben Boonen published the exploit code. Their full exploit chain targets vulnerable Windows 11 22H2 installations.
The release relates to a flaw that Microsoft patched in January 2023 rather than to a newly discovered Windows vulnerability. IBM published the researchers’ technical analysis on March 21, 2023.
The issue has a CVSS score of 7.8. It requires only low-level local privileges and no user interaction and does not provide a direct remote access path. The bug resides in afd.sys, a Windows kernel driver that services requests from the WinSock networking interface.
According to IBM’s analysis, the researchers compared driver builds from December 2022 and January 2023 to identify what Microsoft changed. Only one function, AfdNotifyRemoveIoCompletion, showed differences, which helped narrow the investigation.
The earlier driver failed to validate a memory pointer supplied by a user-mode application. That missing check allowed a local attacker to write to kernel memory, where Windows keeps sensitive system structures.
Microsoft’s patched code added validation so that pointers passed from user mode are checked to ensure they reference appropriate user-space memory rather than protected kernel addresses.
POC for Windows WinSock Ancillary Vulnerability
The researchers say they diagnosed, reproduced, and developed a working exploit in about a day despite having no prior experience with this driver.
Their work illustrates how comparing patched and unpatched binaries can reveal enough information to build an exploit quickly.
The public GitHub repository is described as a demonstration. The authors state the complete privilege escalation chain works on vulnerable Windows 11 22H2 systems, while the basic memory-write primitive functions across affected versions. These are distinct claims and the repository does not guarantee full exploit compatibility with every impacted Windows release.
To escalate from a limited memory write to broader control, the exploit manipulates Windows I/O ring objects, which underpin queued input/output operations. The technique builds on prior research by Yarden Shafir to enable kernel memory reads and writes. The exploit then swaps a target process’s security token for one that has SYSTEM privileges.
IBM also reported that 360 IceSword Lab observed a separate exploit in the wild in January 2023. That sample used the ProcessSocketNotifications interface rather than the direct driver approach the researchers published. This observation does not indicate attackers used the GitHub code.
Administrators should confirm that affected systems have received Microsoft’s January 2023 fix or subsequently applicable updates. IBM’s demonstration worked even when HVCI was enabled, underscoring that such protections do not replace timely patching.
Related coverage includes exploitation of CVE-2024-38193 and the CVE-2025-32709 WinSock zero-day. Both issues involve the same driver but are distinct vulnerabilities with different causes and fixes.
Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.
