Microsoft Zero-Day CVE-2024-38193 was exploited by North Korea
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-21338 | Local Privilege Escalation in Microsoft Windows Kernel via Exposed IOCTL (CVE-2024-21338) CVE-2024-21338 is a local privilege escalation flaw in the Microsoft Windows kernel caused by an exposed IOCTL with insufficient access control (CWE-822): a low-privileged process running locally can issue specially crafted requests to a kernel interface without proper authorization checks. Public research (including Avast's analysis of Lazarus Group's FudModule rootkit) ties the vulnerable component to the Windows AppLocker/AppID driver and shows the bug was exploited as an admin-to-kernel zero-day, letting an attacker with a foothold on a machine gain kernel-level privileges and full control of the host. Because it requires only local access, it is typically chained after initial access or malware delivery, and CISA notes known ransomware use alongside exploitation by North Korea's Lazarus Group. Any organization or device running Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), or Windows Server 2019/2022 (including 2022 23H2) is affected until patched. The bug was added to the CISA Known Exploited Vulnerabilities catalog on 2024-03-04 after in-the-wild exploitation and was fixed in Microsoft's March 2024 Patch Tuesday release; EPSS places the 30-day exploitation probability at roughly 60% (99th percentile). Do: Apply Microsoft's March 2024 (or later) cumulative security updates to every listed Windows 10, Windows 11, and Windows Server 2019/2022 system, and verify the installed build includes the March 2024 fixes before closing the KEV entry; if patches are unavailable, follow CISA's required action to apply vendor mitigations or discontinue use. Because this is a local-only escalation commonly chained after initial access, prioritize workstations and servers where untrusted users or code run locally. Hunt for Lazarus/FudModule and BYOVD-related indicators per Avast's published research on hosts of interest. | 7.8 | 60% | KEV ransomware PoC ×3 |
| masson the order of 1 billion devices (essentially the entire supported Windows 10/11 and Windows Server 2019/2022 installed base) | |
| CVE-2024-38193 | Use-After-Free Privilege Escalation in Microsoft Windows WinSock Driver (afd.sys) The Windows Ancillary Function Driver for WinSock (afd.sys) contains a use-after-free flaw (CWE-416) that allows a local attacker to escalate privileges. An attacker who can already execute code on a Windows host — typically after gaining initial access via phishing, malware, or chaining with another vulnerability — triggers the bug to gain SYSTEM-level privileges, giving them near-full control of the machine. Any Windows host running an affected build is exposed to the flaw, though it requires local code execution and is not remotely exploitable on its own. Exploitation is confirmed in the wild: CISA added the CVE to the KEV catalog on 2024-08-13 and Microsoft shipped fixes in its August 2024 security updates, while the ransomware association is currently listed as unknown. EPSS is elevated at 28.5% (98th percentile), indicating a high likelihood of continued exploitation over the next 30 days. Do: Apply Microsoft's August 2024 Windows cumulative security updates (released 2024-08-13) across all Windows clients and servers, prioritizing multi-user hosts such as RDS/VDI servers and jump boxes where local code execution by low-privileged users is more likely. After patching, verify installed build numbers and hunt for signs of local privilege escalation, per CISA's KEV required action to apply vendor mitigations or discontinue use. Keep the host within your KEV remediation SLA, as listing in the catalog signals active exploitation. | 7.8 | 29% | KEV PoC |
| mass>1 billion Windows endpoints worldwide, i.e., effectively every unpatched Windows client or server |
Full article768 words · extracted from securityaffairs.com · click to collapse
Microsoft addressed a zero-day vulnerability actively exploited by the North-Korea-linked Lazarus APT group.
Microsoft has addressed a zero-day vulnerability, tracked as CVE-2024-38193 (CVSS score: 7.8), which has been exploited by the North Korea-linked Lazarus APT group.
The vulnerability, tracked as CVE-2024-38193 (CVSS score: 7.8), is a privilege escalation issue that resides in the Windows Ancillary Function Driver (AFD.sys) for WinSock.
Microsoft addressed the vulnerability with Path Tuesday security updates released in August 2024, the IT giant also warned that the flaw was exploited in attacks in the wild.
An attacker can exploit this vulnerability to gain SYSTEM privileges, the flaw was reported by Luigino Camastra and Milánek with Gen Digital.
“Gen Threat Labs recently uncovered and reported a major security flaw known as a zero-day vulnerability (CVE-2024-38193), which Microsoft has now fixed. This repair is important because it addresses a security issue that was being used by the Lazarus APT group, a North Korean hacker group known for targeting specific professionals.” reads the post published by Gen Digital.
In early June, Gen Digital researchers discovered that the North Korea-linked APT Lazarus was exploiting a zero-day in the AFD.sys driver to gain unauthorized access to sensitive system areas. The attackers used a “special type of malware” called Fudmodule to avoid detection.
“The vulnerability allowed attackers to bypass normal security restrictions and access sensitive system areas that most users and administrators can’t reach. This type of attack is both sophisticated and resourceful, potentially costing several hundred thousand dollars on the black market.” continues the report. “This is concerning because it targets individuals in sensitive fields, such as those working in cryptocurrency engineering or aerospace to get access to their employer’s networks and steal crypto currencies to fund attackers’ operations.”
In February 2024, Avast discovered an in-the-wild exploit for a previously unknown zero-day vulnerability in the AppLocker driver (appid.sys). Microsoft quickly fixed this vulnerability, now tracked as CVE-2024-21338, in the February Patch Tuesday update. The Lazarus Group exploited the zero-day to gain kernel-level access and disable security software. In past attacks threat actors achieved the same goal by using much noisier BYOVD (Bring Your Own Vulnerable Driver) techniques to cross the admin-to-kernel boundary.
Lazarus exploited the vulnerability CVE-2024-21338 to perform direct kernel object manipulation in an updated version of their FudModule rootkit.
“the holy grail of admin-to-kernel is going beyond BYOVD by exploiting a zero-day in a driver that’s known to be already installed on the target machine. To make the attack as universal as possible, the most obvious target here would be a built-in Windows driver that’s already a part of the operating system.” reads the analysis published by Avast.
“Discovering an exploitable vulnerability in such a driver is significantly more challenging than in the previous BYOVD scenarios for two reasons. First, the number of possible target drivers is vastly smaller, resulting in a much-reduced attack surface. Second, the code quality of built-in drivers is arguably higher than that of random third-party drivers, making vulnerabilities much more difficult to find.”
The new version of the rootkit can suspend PPL (Protected Process Light) protected processes associated with Microsoft Defender, CrowdStrike Falcon, and HitmanPro.
The flaw CVE-2024-21338 resides within the IOCTL (Input and Output Control) dispatcher of the driver appid.sys. This driver is a core component of the AppLocker application, which is used to control which apps and files users can run.
Lazarus exploited the zero-day in the appid.sys driver by manipulating the Input and Output Control (IOCTL) dispatcher. This manipulation allows them to arbitrary code on the target system, bypassing security measures.
“The entire goal of the admin-to-kernel exploit was to corrupt the current thread’s PreviousMode. This allows for a powerful kernel read/write primitive, where the affected user-mode thread can read and write arbitrary kernel memory using the Nt(Read|Write)VirtualMemory syscalls. Armed with this primitive, the FudModule rootkit employs direct kernel object manipulation (DKOM) techniques to disrupt various kernel security mechanisms. It’s worth reiterating that FudModule is a data-only rootkit, meaning it executes entirely from user space and all the kernel tampering is performed through the read/write primitive.” reads the report.
With their valuable admin-to-kernel zero-day exposed, Lazarus’s ability to bypass security has been significantly hampered. They must now choose between finding a new critical exploit or reverting to their older, less potent BYOVD tactics
The researchers noticed that with their valuable admin-to-kernel zero-day exposed, Lazarus’s ability to bypass security has been significantly hampered. They must now choose between finding a new critical exploit or reverting to their older, less potent BYOVD tactics.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – OpenAI, Lazarus)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/167246/apt/microsoft-zero-day-cve-2024-38193-lazarus.html