Micropatches for Windows Local Session Manager Elevation of Privilege (CVE-2023-21771)

In December of 2022, Ben Barnea of Akamai posted an X thread about a bug they had found in Windows Local Service Manager (LSM) that can lead to local privilege escalation from regular user account to Local System. Ben discovered that code in LSM was missing a return value check after a call is made to RpcImpersonateClient to impersonate the caller: a failed impersonation attempt would therefore keep the code running as Local System.

After trying out several ideas to …

account akamai ben bug can check code cve december elevation of privilege escalation found local local privilege escalation manager missing privilege privilege escalation regular return service session system value windows