CVE-2023-36046: Windows 11 21h2 DoS Vulnerability

CVE-2023-36046 Overview

CVE-2023-36046 is a Denial of Service vulnerability affecting the Windows Authentication subsystem. This vulnerability allows a local attacker with low privileges to cause a denial of service condition, potentially disrupting authentication services and impacting system integrity and availability. The vulnerability is classified as a Symlink Attack (CWE-59), indicating improper handling of symbolic links within the authentication mechanism.

Critical Impact

Local attackers can exploit this vulnerability to cause denial of service in Windows Authentication, potentially disrupting authentication operations across affected Windows 11 and Windows Server 2022 systems.

Affected Products

• Microsoft Windows 11 21H2 (x64 and ARM64)
• Microsoft Windows 11 22H2 (x64 and ARM64)
• Microsoft Windows 11 23H2 (x64 and ARM64)
• Microsoft Windows Server 2022

Discovery Timeline

• November 14, 2023 - CVE-2023-36046 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-36046

Vulnerability Analysis

This vulnerability exists in the Windows Authentication component and stems from improper handling of symbolic links (CWE-59). The flaw enables a locally authenticated attacker to manipulate the authentication subsystem, leading to denial of service conditions. Successful exploitation does not require user interaction and can be achieved with low-complexity attacks by users with limited privileges.

The vulnerability impacts both the integrity and availability of the affected systems, allowing attackers to potentially corrupt authentication data or render authentication services unavailable. While confidentiality is not directly impacted, the disruption to authentication services could have cascading effects on system security.

Root Cause

The root cause of CVE-2023-36046 is identified as CWE-59: Improper Link Resolution Before File Access ('Link Following'). The Windows Authentication component fails to properly validate or resolve symbolic links before performing file operations. This allows an attacker to create malicious symbolic links that redirect authentication-related file operations to unintended locations, causing integrity violations or service disruption.

Attack Vector

The attack vector for CVE-2023-36046 is local, meaning an attacker must have authenticated access to the target system. From this position, the attacker can craft malicious symbolic links that exploit the improper link resolution in the Windows Authentication subsystem. The attack does not require elevated privileges beyond basic local user access, and no user interaction is necessary for successful exploitation.

The exploitation mechanism involves creating symbolic links that redirect file operations performed by the authentication subsystem. When the vulnerable component follows these malicious links without proper validation, it may write to or modify unintended files, corrupt authentication data structures, or encounter error conditions that result in denial of service.

Detection Methods for CVE-2023-36046

Indicators of Compromise

• Unexpected symbolic links created in Windows authentication-related directories
• Authentication service failures or unexpected restarts of lsass.exe or related processes
• Event log entries indicating authentication subsystem errors or access violations
• Unusual file system activity involving symbolic links by non-administrator accounts

Detection Strategies

• Monitor Windows Security Event Logs for authentication failures and service disruptions (Event IDs 4625, 4771)
• Implement file integrity monitoring on authentication-critical directories
• Use SentinelOne's behavioral AI to detect anomalous symbolic link creation patterns
• Configure endpoint detection rules to alert on suspicious symlink operations targeting system directories

Monitoring Recommendations

• Enable detailed auditing for object access and symbolic link creation in Windows Security Policy
• Deploy SentinelOne agents with Storyline Active Response (STAR) rules to detect exploitation attempts
• Monitor lsass.exe and authentication service health metrics for anomalies
• Implement centralized logging to correlate authentication failures across affected systems

How to Mitigate CVE-2023-36046

Immediate Actions Required

• Apply Microsoft security updates released as part of the November 2023 Patch Tuesday
• Audit systems for unauthorized symbolic links in authentication-related directories
• Review and restrict user permissions for creating symbolic links where possible
• Enable SentinelOne's real-time protection to detect and block exploitation attempts

Patch Information

Microsoft has released security updates to address this vulnerability. Administrators should refer to the Microsoft Security Response Center advisory for CVE-2023-36046 for detailed patch information and download links specific to each affected Windows version.

Ensure all affected systems—including Windows 11 21H2, 22H2, 23H2, and Windows Server 2022—are updated through Windows Update, WSUS, or your organization's patch management solution.

Workarounds

• Restrict symbolic link creation privileges using local security policy (SeCreateSymbolicLinkPrivilege)
• Implement application control policies to monitor and restrict file system operations by untrusted processes
• Use SentinelOne's firewall and device control features to limit attack surface
• Consider network segmentation to isolate critical authentication infrastructure until patches are applied

# Check current symbolic link privilege assignments
whoami /priv | findstr "SeCreateSymbolicLinkPrivilege"

# Verify patch installation status for November 2023 updates
wmic qfe list brief | findstr "KB"