CVE-2023-36046: Windows 11 21h2 Authentication DoS Flaw

CVE-2023-36046 Overview

CVE-2023-36046 is a Windows Authentication Denial of Service vulnerability affecting Microsoft Windows 11 and Windows Server 2022. The flaw is categorized under [CWE-59] Improper Link Resolution Before File Access (Link Following). An authenticated local attacker can leverage the issue to disrupt authentication services and tamper with integrity-protected resources on the host.

The vulnerability requires local access and low privileges, with no user interaction needed. Successful exploitation results in high impact to both integrity and availability of the affected system, though confidentiality is not directly impacted.

Critical Impact
A local, authenticated attacker can exploit a link-following weakness in Windows authentication components to cause denial of service and modify protected files on Windows 11 and Windows Server 2022 systems.

Affected Products

Microsoft Windows 11 21H2 (x64 and ARM64)
Microsoft Windows 11 22H2 and 23H2 (x64 and ARM64)
Microsoft Windows Server 2022

Discovery Timeline

2023-11-14 - CVE-2023-36046 published to NVD
2023-11-14 - Microsoft publishes security update guidance for CVE-2023-36046
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36046

Vulnerability Analysis

The vulnerability resides in Windows authentication handling and is classified as [CWE-59] Improper Link Resolution Before File Access. The defect allows a local attacker holding low-privilege credentials to manipulate symbolic links or junctions that are dereferenced by a privileged authentication component. When the component follows the attacker-controlled link, it operates on a file or resource the attacker would not normally be able to modify.

The attack requires local code execution on the target system and no user interaction. The combination of high integrity impact and high availability impact reflects the ability to both alter and destroy authentication-related state. Confidentiality is unaffected, indicating that the primary risk is disruption of authentication services and tampering with protected files rather than data theft.

Microsoft addressed CVE-2023-36046 as part of its November 2023 security update cycle. At the time of writing, there is no public proof-of-concept exploit, the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the EPSS probability remains low.

Root Cause

The root cause is improper validation of file system links before access by a Windows authentication component running with elevated privileges. The process opens or writes to a target path without verifying that the path resolves to a non-attacker-controlled location, allowing junction or symlink redirection.

Attack Vector

An authenticated local user stages a symbolic link, NTFS junction, or hard link in a directory accessible to the vulnerable authentication service. The privileged service follows the link and performs file operations on a resource of the attacker's choosing, corrupting authentication state and inducing denial of service.

No verified public exploit code is available for CVE-2023-36046. Refer to the Microsoft Security Update Guide for CVE-2023-36046 for vendor technical details.

Detection Methods for CVE-2023-36046

Indicators of Compromise

Unexpected creation of NTFS junctions, symbolic links, or hard links by non-administrative users in directories used by authentication services.
Authentication subsystem crashes, repeated lsass.exe errors, or sudden inability of users to authenticate locally or to domain resources.
File integrity changes to authentication-related files outside of scheduled Windows update windows.

Detection Strategies

Monitor Windows Security and System event logs for authentication service failures, service restarts, and Event ID 4673/4674 patterns that correlate with low-privileged accounts.
Audit creation of reparse points using Sysmon Event ID 11 and File System auditing for FILE_FLAG_OPEN_REPARSE_POINT operations originating from user-writable directories.
Correlate local logon events with subsequent privileged file writes to detect link-following exploitation chains.

Monitoring Recommendations

Enable object access auditing on directories used by authentication components and forward events to a centralized SIEM for correlation.
Track installation status of the November 2023 Microsoft security updates across Windows 11 and Windows Server 2022 endpoints using your patch management platform.
Alert on anomalous use of mklink, CreateSymbolicLink, or junction-creation tooling by non-administrative principals.

How to Mitigate CVE-2023-36046

Immediate Actions Required

Apply the Microsoft security update for CVE-2023-36046 to all Windows 11 21H2, 22H2, 23H2, and Windows Server 2022 systems.
Inventory unpatched hosts and prioritize remediation for multi-user systems, terminal servers, and domain controllers where local attackers are most likely to be present.
Restrict interactive and remote interactive logon rights to trusted administrators where feasible to reduce the local attack surface.

Patch Information

Microsoft released a security update addressing CVE-2023-36046 on November 14, 2023. Patch details and download links are available in the Microsoft Security Update Guide for CVE-2023-36046. Apply the cumulative update appropriate for each affected Windows build.

Workarounds

Microsoft has not published an officially supported workaround; patching is the recommended remediation path.
As a defense-in-depth measure, remove the SeCreateSymbolicLinkPrivilege right from standard users via Group Policy under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment.
Limit write access to directories consumed by authentication components and enforce least-privilege ACLs on shared filesystem locations.

bash

# Verify the security update is installed on Windows 11 / Server 2022
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2023-11-14') }

# Audit non-admin users holding SeCreateSymbolicLinkPrivilege
secedit /export /cfg C:\Windows\Temp\secpol.cfg
Select-String -Path C:\Windows\Temp\secpol.cfg -Pattern 'SeCreateSymbolicLinkPrivilege'