In early 2022, Microsoft disclosed a serious elevation of privilege vulnerability: CVE-2022-23293. This bug was present in the Windows Fast FAT File System Driver (fastfat.sys), a kernel-mode driver responsible for handling FAT file systems (like those on USB sticks and SD cards). Attackers could exploit this flaw to run code with the highest privileges—giving them near-total control over Windows systems.

Let's break down what makes this vulnerability dangerous, how it can be exploited, and what you should do about it.

What is CVE-2022-23293?

CVE-2022-23293 is an Elevation of Privilege (EoP) flaw. It impacts the fastfat.sys driver, which is loaded by default on all supported versions of Windows. If exploited, an attacker could gain SYSTEM-level privileges—far above a regular user's rights.

fastfat.sys is always present.

- Attackers who exploit it get full control—read, write, or delete any system file, install malware, etc.

Root Cause

The bug stems from how the Fast FAT driver handles certain file operations on FAT-formatted volumes. Specifically, insufficient checks and incorrect handling of reparse points or directory junctions allow a regular user to trick the driver into following a crafted path.

How This Works In Practice

Suppose you have a FAT32-formatted USB stick. A user with limited permissions can create a directory and set up a reparse point (like a symbolic link) that shadows a location elsewhere on the system—perhaps one that's normally hidden or protected. When fastfat.sys processes this crafted structure, it can mistakenly change file permissions or ownership outside the user's boundary.

Proof-of-Concept: Simulating the Exploit

Quick warning: This is for educational purposes only! Never use exploits against systems you don't own or have explicit permission to test.

Here's a simplified code flow that demonstrates the core logic behind the exploit, inspired by public PoCs and advisories:

// This is a conceptual snippet, not a full exploit!

// Step 1: Mount a FAT32 USB stick (e.g., at E:\ )
// Step 2: Create a directory that will become our "attack point"

mkdir("E:\\testdir");

// Step 3: Using Win32 API, create a reparse point or mount point inside testdir
// (On NTFS, this would be a symlink or directory junction; on FAT, advanced tools are needed.)

// Set up a reparse point to \Windows\System32
// (Use DeviceIoControl with FSCTL_SET_REPARSE_POINT; needs special privileges or a helper tool)

// Step 4: Trigger operation via fastfat.sys, such as renaming or copying a file
// This forces fastfat.sys to process the reparse point, potentially escalating privileges

This code is not weaponized, but points to the main idea: redirect file system operations to privileged locations via crafted link points, exploiting the driver's naive trust in the reparse information.

Public PoC Example

Researcher @S3cur3Th1sSh1t published a PoC here:  
👉 GitHub: S3cur3Th1sSh1t/CVE-2022-23293_poc

Microsoft Advisory:

Microsoft Security Update Guide: CVE-2022-23293

Write-up:

Windows FastFAT Elevation of Privilege

GitHub PoC:

https://github.com/S3cur3Th1sSh1t/CVE-2022-23293_poc

Gain Local Access: The attacker must have code execution as a non-privileged user.

2. Craft Malicious FAT Volume: They plug in a USB stick with the specifically crafted file/directory structure.
3. Trigger the Vulnerable Operation: By running a sequence (copy, rename, set permissions) they convince fastfat.sys to apply changes as SYSTEM.

Who Is At Risk?

- All Windows versions (before patches), both client (Windows 10, 11) and server (2019, 2022, etc.)
- Particularly dangerous on shared environments (workstations, kiosks, servers with multiple users)

Apply the Patch!

Microsoft released a fix as part of the February 2022 Patch Tuesday. Update your systems immediately.

Final Thoughts

CVE-2022-23293 is a prime example of how even ancient parts of Windows can harbor modern security risks. Simple file system drivers—used for decades—might be overlooked, but they operate with high privileges and can become a dangerous attack surface.

Patching is essential. And if you manage endpoints in a business, consider stricter policies around external storage devices, as these bugs are often abused in real-world attacks.

Stay safe, stay patched!

*Interested in more Windows vulnerability breakdowns? Let us know on our socials or leave a comment below!*

Timeline

Published on: 03/09/2022 17:15:00 UTC
Last modified on: 05/23/2022 17:29:00 UTC