Sunday, February 9, 2025
HomeCVE/vulnerabilityPoC Exploit Released For 0-Day Windows Kernel Privilege Escalation Vulnerability

PoC Exploit Released For 0-Day Windows Kernel Privilege Escalation Vulnerability

Published on

SIEM as a Service

Follow Us on Google News

Microsoft released several patches for multiple vulnerabilities during the Patch Tuesday for August 2024. One of the vulnerabilities listed by Microsoft was the CVE-2024-38106.

This vulnerability is associated with Windows Kernel Privilege Escalation affecting multiple Microsoft Windows OSes including Windows 10, 11 and Windows Server (2016, 2019, 2022). 

Moreover, Microsoft stated that this vulnerability was actively exploited by threat actors.

As a matter of fact, Microsoft also mentioned that no user interaction was required for exploiting this vulnerability.

The severity for this vulnerability was given as 7.0 (High).

Technical Analysis – CVE-2024-38106

According to the reports shared with Cyber Security News, CVE-2024-38106 was linked to a race condition.

Successful exploitation of this vulnerability could lead to the threat actor gaining SYSTEM level privileges on the affected system.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14 day free trial

Further, it was stated that the vulnerability was a little complex to exploit.

Researchers at Pixiepoint investigated the patch for this vulnerability. It was revealed that the fix was made on the ntoskrnl.exe that was also responsible for several other bugs fixed by Microsoft.

On analyzing further, there were two security changes made to the functions VslGetSetSecureContext() and NtSetInformationWorkerFactory().

Fix analysis (Source: Pixiepoint)

VslGetSetSecureContext() was implemented with a fix to mitigate a race condition. This was done by making the function properly lock the VslpEnterIumSecureMode() operation that was related to the VBS secure kernel.

NtSetInformationWorkerFactory() was implemented with a similar fix for mitigating a race condition.

However, here it was done by adding a flag inside NtShutdownWorkerFactory() –> ExpShutdownWorkerFactory():

However, the proof of concept code can be found below. As per the proof of concept, it triggers calling the NtClose() on worker factory object handles to achieve a vulnerable state.

This will result in reaching KiInsertTimer2WithCollectionLockHeld() worker factory object and freeing the associated timer.

Organizations should apply the necessary patches to vulnerable products to prevent them from being exploited.

What Does MITRE ATT&CK Expose About Your Enterprise Security? - Watch Free Webinar!

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

UK Pressures Apple to Create Global Backdoor To Spy on Encrypted iCloud Access

United Kingdom has reportedly ordered Apple to create a backdoor allowing access to all...

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

UK Pressures Apple to Create Global Backdoor To Spy on Encrypted iCloud Access

United Kingdom has reportedly ordered Apple to create a backdoor allowing access to all...

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...