CVE-2023-36718: Windows 10 1507 vTPM RCE Vulnerability

CVE-2023-36718 Overview

CVE-2023-36718 is a Remote Code Execution (RCE) vulnerability affecting the Microsoft Virtual Trusted Platform Module (vTPM) component across multiple Windows operating system versions. This vulnerability allows an attacker with local access and low privileges to execute arbitrary code on the target system. Due to the nature of the vTPM component, which is integral to virtualized security features including Hyper-V guest isolation, successful exploitation could potentially allow an attacker to escape from a guest virtual machine and impact the host system or other guests.

Critical Impact

Successful exploitation of this vulnerability enables code execution that can cross security boundaries, potentially compromising the confidentiality, integrity, and availability of the host system in virtualized environments.

Affected Products

• Microsoft Windows 10 1507 (x64)
• Microsoft Windows 10 1607 (x64)
• Microsoft Windows 10 1809 (x64)
• Microsoft Windows 10 21H2 (x64)
• Microsoft Windows 10 22H2 (x64)
• Microsoft Windows 11 21H2
• Microsoft Windows 11 22H2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022

Discovery Timeline

• October 10, 2023 - CVE-2023-36718 published to NVD
• February 28, 2025 - Last updated in NVD database

Technical Details for CVE-2023-36718

Vulnerability Analysis

This vulnerability exists within the Microsoft Virtual Trusted Platform Module (vTPM) implementation, a software-based emulation of the Trusted Platform Module 2.0 used in Hyper-V virtual machines. The vTPM provides cryptographic services and secure storage for virtualized workloads, making it a critical security component for organizations leveraging virtualization technologies.

The vulnerability is classified under CWE-94 (Code Injection), indicating that the flaw allows an attacker to inject and execute malicious code within the context of the vTPM component. The attack requires local access to the system and low-level privileges, though the complexity of successful exploitation is considered high. What makes this vulnerability particularly concerning is its ability to change scope—meaning exploitation within a guest VM could potentially affect the host system or other VMs sharing the same physical hardware.

Root Cause

The root cause of CVE-2023-36718 is improper code generation control within the vTPM component. Specifically, the vulnerability stems from insufficient validation or sanitization of inputs processed by the vTPM, which can be manipulated to inject arbitrary code. This code injection weakness (CWE-94) allows attackers to craft malicious inputs that, when processed by the vTPM, result in the execution of attacker-controlled code rather than legitimate TPM operations.

Attack Vector

The attack vector for CVE-2023-36718 is local, requiring the attacker to have existing access to a guest virtual machine running on affected Windows systems with vTPM enabled. The exploitation flow typically involves:

1. An attacker gains initial access to a Hyper-V guest VM with low-level privileges
2. The attacker crafts malicious inputs designed to exploit the code injection vulnerability in the vTPM component
3. These inputs are submitted to the vTPM through legitimate TPM API calls
4. Due to improper input handling, the malicious code is executed in the context of the vTPM process
5. Successful exploitation can lead to VM escape, allowing the attacker to compromise the host system or other guest VMs

The vulnerability mechanism involves improper handling of TPM commands within the virtualized environment. The vTPM processes requests from guest operating systems, and insufficient validation of these requests creates an opportunity for code injection. Technical details regarding specific exploitation techniques can be found in the Microsoft Security Update Guide.

Detection Methods for CVE-2023-36718

Indicators of Compromise

• Unusual or unexpected process spawning from vTPM-related system components
• Abnormal memory access patterns in Hyper-V worker processes (vmwp.exe)
• Suspicious TPM API calls originating from guest VMs with unusual parameters
• Unexpected system behavior or crashes in the Virtual Machine Worker Process

Detection Strategies

• Monitor Windows Event Logs for Hyper-V-related errors, particularly events related to vTPM operations (Event IDs in the Hyper-V-Worker and Hyper-V-VMMS providers)
• Implement endpoint detection rules to identify anomalous behavior in vmwp.exe and related Hyper-V processes
• Deploy behavior-based detection to identify code injection attempts targeting virtualization components
• Enable and review Windows Defender Credential Guard logs for suspicious TPM-related activities

Monitoring Recommendations

• Enable verbose logging for Hyper-V components and centralize logs for analysis
• Implement SentinelOne's behavioral AI to detect exploitation attempts targeting virtualization infrastructure
• Configure alerts for unexpected privilege escalation or lateral movement from guest VMs
• Regularly audit vTPM-enabled VMs and ensure they are running patched operating system versions

How to Mitigate CVE-2023-36718

Immediate Actions Required

• Apply the October 2023 security updates from Microsoft to all affected Windows systems
• Prioritize patching of Hyper-V hosts running vTPM-enabled guest virtual machines
• Review and restrict access to guest VMs that have vTPM enabled
• Implement network segmentation to limit lateral movement potential if exploitation occurs

Patch Information

Microsoft released security updates addressing CVE-2023-36718 as part of the October 2023 Patch Tuesday release. The patch corrects the code injection vulnerability in the vTPM component by implementing proper input validation and sanitization. Organizations should obtain the appropriate patches from the Microsoft Security Update Guide for CVE-2023-36718 based on their specific Windows versions.

Workarounds

• Consider temporarily disabling vTPM for non-critical guest VMs until patches can be applied
• Implement strict access controls to limit who can interact with Hyper-V guest VMs
• Enhance monitoring of Hyper-V environments to detect potential exploitation attempts
• Review and enforce the principle of least privilege for all users with access to virtualized environments

# Verify Windows patch level using PowerShell
Get-HotFix | Where-Object {$_.InstalledOn -ge "2023-10-10"} | Sort-Object InstalledOn -Descending

# Check vTPM status on Hyper-V VMs
Get-VM | Get-VMSecurity | Select-Object VMName, TpmEnabled, EncryptStateAndVmMigrationTraffic