【已复现】Windows Backup Service 权限提升漏洞(CVE-2023-21752)安全风险通告

漏洞名称

Windows Backup Service权限提升漏洞(CVE-2023-21752)

公开时间

2023-01-10

更新时间

2023-01-12

CVE编号

CVE-2023-21752

其他编号

QVD-2023-1873

威胁类型

权限提升

技术类型

条件竞争

厂商

Microsoft

产品

Windows

风险等级

奇安信CERT风险评级

风险等级

高危

蓝色（一般事件）

现时威胁状态

POC状态

EXP状态

在野利用状态

技术细节状态

已公开

已公开

未知

未发现

漏洞描述

Windows 备份服务存在权限提升漏洞，经过身份认证的攻击者可利用此漏洞提升至 SYSTEM 权限。成功利用此漏洞需要攻击者赢得竞争条件。

影响版本

Windows 7 for 32-bit Systems Service Pack 1

Windows 10 for 32-bit Systems

Windows 10 Version 1607 for x64-based Systems

Windows 10 for x64-based Systems

Windows 7 for x64-based Systems Service Pack 1

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for 32-bit Systems

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows 11 Version 22H2 for x64-based Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 22H2 for x64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 version 21H2 for ARM64-based Systems

Windows 11 version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 22H2 for 32-bit Systems

Windows 11 Version 22H2 for ARM64-based Systems

Windows 10 Version 22H2 for ARM64-based Systems

其他受影响组件

无