Windows CNG Key Isolation Service Privilege Escalation Vulnerability (CVE-2023-28229) Analysis and Mitigation Guide

1. Vulnerability Overview & Root Cause

This vulnerability is a Local Privilege Escalation (LPE) vulnerability in the Windows CNG (Cryptography Next Generation) Key Isolation service (KeyIso). The CNG Key Isolation service is hosted in the LSA (Local Security Authority) process and isolates private keys and associated cryptographic operations. The root cause lies in the improper handling of symbolic links or object handles (CWE-591) during inter-process communication (IPC), allowing low-privileged users to manipulate resources owned by high-privileged processes.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first gain local execution capabilities on the target Windows machine (e.g., via phishing or exploiting a separate remote entry-point vulnerability). Once local access is established, the attacker monitors or targets the IPC channels or file paths utilized by the KeyIso service. By leveraging symbolic link redirection or hard link manipulation, the attacker tricks the SYSTEM-privileged service into loading a malicious payload or DLL, resulting in arbitrary code execution under the SYSTEM context.

3. Infrastructure & Business Impact

As this vulnerability is cataloged in CISA's Known Exploited Vulnerabilities (KEV), it represents a highly active threat vector. While LPE vulnerabilities require local access, they are critical components of multi-stage attack chains. Threat actors utilize them to bypass security controls, perform lateral movement, compromise Active Directory Domain Controllers, and deploy ransomware, posing severe risks to business continuity and data confidentiality.