Vulnerability landscape analysis for Q4 2024
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office and WordPad that stems from improper parsing of specially crafted files. Attackers trigger it by getting a user to open a malicious document, after which attacker-controlled code executes with the privileges of the logged-in user. Anyone running the affected Microsoft Office or WordPad software is exposed, and CISA notes the flaw has been leveraged in ransomware campaigns; no CVSS score is available in the source data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile), indicating active, ongoing exploitation. Do: Apply Microsoft's security updates for Office and Windows per vendor instructions, as required by CISA's KEV catalog; the flaw was publicly reported as fixed in Microsoft's April 2017 security updates. Until patched, treat unsolicited Office documents and email attachments as high-risk, since exploitation requires a user to open a crafted file. Verify that all Office and WordPad installations across the estate—especially endpoints that handle untrusted documents—have received the update. | 7.8 | 100% | KEV ransomware PoC ×6 |
| masshundreds of millions of Office installations worldwide (exact count unknown) | |
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) | |
| CVE-2018-0802 | Memory Corruption RCE in Microsoft Office Equation Editor A memory-corruption flaw (out-of-bounds write, CWE-787) in the legacy Equation Editor component (EQNEDT32.EXE) shipped with Microsoft Office 2007, 2010, 2013, and 2016 allows remote code execution due to improper handling of objects in memory. An attacker triggers it by persuading a user to open a specially crafted document (for example an RTF or DOCX containing a malformed embedded equation object), causing the Equation Editor process to corrupt memory when the file is opened in Word; the user-interaction requirement is reflected in the CVSS 3.1 vector (AV:L/UI:R). Successful exploitation gives the attacker code execution in the context of the current user, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.8, High). Any user of the affected Office versions, the Office Compatibility Pack, or Word on an unpatched system is affected. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, carries a 93.3% EPSS probability of exploitation within 30 days, and multiple public analyses and proof-of-concepts exist. Do: Apply Microsoft's January 2018 security updates for Office 2007, 2010, 2013, and 2016 and the Office Compatibility Pack, and verify the legacy Equation Editor executable (EQNEDT32.EXE) on endpoints has been patched or removed (Microsoft later retired the component). Because the flaw is exploited in the wild and used in ransomware campaigns, prioritize remediation per CISA KEV required action and hunt for Word spawning EQNEDT32.EXE or unexpected child processes when documents are opened. Until patched, open untrusted documents in Protected View and treat email-delivered RTF/DOCX attachments as untrusted. | 7.8 | 93% | KEV ransomware PoC ×3 |
| masshundreds of millions of Office users at time of disclosure (vulnerable Equation Editor shipped by default with Office 2007-2016); largely patched today, with… | |
| CVE-2022-0847 | Local Privilege Escalation ('Dirty Pipe') in the Linux Kernel CVE-2022-0847, widely known as 'Dirty Pipe,' is a privilege escalation flaw in the Linux kernel caused by improper initialization of the 'flags' member of the new pipe buffer structure in the copy_page_to_iter_pipe and push_pipe functions, allowing stale flag values to persist (CWE-665). An unprivileged local user can trigger the flaw by writing through a pipe into the page cache of files they can read, overwriting the contents of otherwise read-only files. This enables tampering with privileged files — for example, hijacking SUID binaries per the public proof-of-concepts — to escalate privileges to root on the local system. Affected products include the Linux kernel as tracked by CISA, with downstream distribution and appliance vendors Fedora, Red Hat Enterprise Linux (including EUS, IBM Z, Power little-endian, and Real Time/NFV variants), oVirt, NetApp, Siemens, and SonicWall. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-04-25), carries an 89.7% EPSS probability of exploitation within 30 days, and multiple public proof-of-concept exploits are available. Do: Apply vendor-supplied fixed kernel updates immediately per the CISA KEV required action, including patches from Fedora and Red Hat Enterprise Linux (all listed variants) and from oVirt, NetApp, Siemens, and SonicWall appliances or products that embed affected kernels; verify the running kernel version on hosts, container hosts, and appliances and reboot into the patched kernel. There is no complete workaround — the kernel itself must be patched — so prioritize multi-user servers, systems running untrusted code or containers, and internet-exposed appliances, since any local account can gain root. | 7.8 | 90% | KEV PoC ×4 |
| mass≈1 billion+ Linux-based systems (servers, cloud VMs, Android/embedded devices) potentially vulnerable on unpatched kernels | |
| CVE-2022-34918 | An issue was discovered in the Linux kernel through 5.18.9. An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c. NVD description · AI analysis pending | 7.8 | 5% | PoC ×4 |
| — | |
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24. Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable. | 7.8 | 98% | KEV ransomware PoC ×4 |
| masshundreds of millions of users/installations worldwide (WinRAR is one of the most widely installed Windows archive utilities) | |
| CVE-2024-0582 | A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and t A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate their privileges on the system. NVD description · AI analysis pending | 7.8 | 13% |
| — | ||
| CVE-2024-1086 | Use-After-Free Local Privilege Escalation in Linux Kernel nf_tables CVE-2024-1086 is a use-after-free vulnerability (CWE-416) in the Linux kernel's netfilter nf_tables component, tracked in CISA's catalog as a Linux Kernel Use-After-Free Vulnerability. A local attacker who can interact with the nf_tables netfilter subsystem can trigger the dangling memory reference to gain elevated privileges on the affected host. Successful exploitation yields local privilege escalation, effectively giving the attacker higher (typically root-level) access on an already-compromised machine. Any Linux system running a kernel with the affected nf_tables code is potentially impacted, which spans most modern server, cloud, and embedded Linux deployments. The flaw is being exploited in the wild: it was added to CISA KEV on 2024-05-30 with known ransomware use, and EPSS assigns a 28.1% probability of exploitation within 30 days (98th percentile). Do: Apply patched kernel updates from your Linux distribution or vendor as soon as they are available, prioritizing hosts listed in CISA KEV (federal agencies must act per the KEV deadline). Until patching, reduce exposure by limiting unprivileged users' ability to create user namespaces and interact with nf_tables, and confirm whether the nf_tables/netfilter modules are loaded on your systems. Because ransomware operators are using this flaw post-compromise, patching should precede or accompany ransomware-hardening reviews on Linux servers. | 7.8 | 28% | KEV ransomware PoC ×4 |
| masshundreds of millions of deployments (Linux is the default kernel across most servers, cloud instances, and embedded devices) | |
| CVE-2024-21447 | Windows Authentication Elevation of Privilege Vulnerability Windows Authentication Elevation of Privilege Vulnerability NVD description · AI analysis pending | 7.8 | 1% |
| — | ||
| CVE-2024-28916 | Xbox Gaming Services Elevation of Privilege Vulnerability Xbox Gaming Services Elevation of Privilege Vulnerability NVD description · AI analysis pending | 8.8 | <1% |
| — | ||
| CVE-2024-38100 | Windows File Explorer Elevation of Privilege Vulnerability Windows File Explorer Elevation of Privilege Vulnerability NVD description · AI analysis pending | 7.8 | 5% |
| — |
Full article1,727 words · extracted from securelist.com · click to collapse
Q4 2024 saw fewer published exploits for Windows and Linux compared to the first three quarters. Although the number of registered vulnerabilities continued to rise, the total number of Proof of Concept (PoC) instances decreased compared to 2023. Among notable techniques in Q4, attackers leveraged undocumented RPC interfaces and targeted the Windows authentication mechanism.
Statistics on registered vulnerabilities
This section contains statistics on registered vulnerabilities. Data is sourced from the CVE portal: cve.org.
Total number of registered vulnerabilities and number of critical ones, Q4 2023 vs. Q4 2024 (download)
In Q4 2024, the trend of documenting software flaws that create vulnerabilities continued to gain momentum. The share of vulnerabilities labeled as critical was slightly higher than in Q4 2023. In general, more and more vulnerabilities are being assigned CVE identifiers through Bug Bounty programs and general software security research. Let’s also examine the number of public exploits.
Number of vulnerabilities, the share of critical ones, and those for which exploits exist, 2019–2024 (download)
As shown in the graph, the number of published exploits for vulnerabilities ended up at around 6%, which is 4 p.p. lower than in 2023. This decline may be due to vendors’ requirements not to disclose information about exploitation methods for discovered vulnerabilities and corresponding exploits—we believe researchers are increasingly encountering such requests. Thus, the main trends of 2024 were the growth in the number of registered vulnerabilities, the decrease in the number of PoCs, and the share of critical vulnerabilities remaining at 2023 levels.
Let’s examine the most popular types of vulnerabilities exploited in real attacks in 2023 and 2024.
Number of vulnerabilities by the most prevalent CWEs used in attacks on users in 2023 (download)
Number of vulnerabilities by the most prevalent CWEs used in attacks on users in 2024 (download)
As in 2023, the top three in the list are the following software issues:
- CWE-78—Improper or insufficient neutralization of command-line inputs (OS Command Injection);
- CWE-20—Improper input filtering and validation. This includes most vulnerabilities that allow attackers to take control of applications;
- CWE-787—Memory corruption vulnerabilities (Out-of-bounds Write).
These types of flaws have been known for a long time and remain actively exploited by attackers. The number of associated vulnerabilities has remained at the same level over the past two years.
Next are software flaws that are less common but no less critical. In 2024, some of the most popular CWEs included the following:
- CWE-416—Improper use of dynamic memory resources (Use After Free);
- CWE-22—Improper handling of file system path formats (Path Traversal);
- CWE-94—Improper control of code generation (Code Injection);
- CWE-502—Deserialization of untrusted data;
- CWE-843—Improper handling of data types (Type Confusion);
- CWE-79—Improper neutralization of input during web page generation (Cross-site Scripting);
- CWE-122—Heap-based Buffer Overflow.
Compared to 2023, CWE-119—associated with performing operations outside buffer bounds—was the only one to drop out of the TOP 10. However, it was replaced by a similar type, CWE-122, associated with buffer overflow—so memory corruption vulnerabilities remained on the list. This confirms that the landscape of software flaws leading to exploitable vulnerabilities has remained unchanged over the past two years.
Exploitation statistics
This section contains statistics on the use of exploits in Q4 2024. The data is based on open sources and our telemetry.
Windows and Linux vulnerability exploitation
Among the exploits detected by Kaspersky solutions for Windows, the most popular throughout 2024, including Q4, were vulnerabilities in Microsoft Office applications:
- CVE-2018-0802—Remote code execution vulnerability in the Equation Editor component;
- CVE-2017-11882—Another remote code execution vulnerability also affecting the Equation Editor;
- CVE-2017-0199—A vulnerability in Microsoft Office and WordPad that allows an attacker to take control of the system.
Following these, the most common vulnerabilities in Q4 included those in WinRAR and various Windows subsystems:
- CVE-2023-38831—A vulnerability in WinRAR related to improper handling of objects contained in an archive;
- CVE-2024-38100—A vulnerability known as Leaked Wallpaper, which allows an attacker to obtain a NetNTLM hash used in user authentication protocols;
- CVE-2024-21447—A vulnerability in improper link handling within the file system. It resides in the UserManager service and, if exploited, allows privilege escalation;
- CVE-2024-28916—A vulnerability similar to CVE-2024-21447 in the Xbox Gaming Service.
Each of the above vulnerabilities can be used to compromise the system and gain the highest possible privileges, so we recommend regularly updating the corresponding software.
Dynamics of the number of Windows users encountering exploits, Q1 2023—Q4 2024. The number of users who encountered exploits in Q1 2023 is taken as 100% (download)
Kaspersky products for the Linux operating system triggered on exploits for the following vulnerabilities:
- CVE-2024-1086—Improper resource handling vulnerability in the nf_tables component of the kernel. Exploiting it allows privilege escalation in the system;
- CVE-2024-0582—A memory leak vulnerability in the io_uring component, which can be used to escalate privileges on the vulnerable system;
- CVE-2022-0847—A widespread vulnerability known as Dirty Pipe, allowing privilege escalation and control over running applications;
- CVE-2022-34918—Improper handling of kernel objects related to the netfilter component. Exploiting the vulnerability allows privilege escalation in the system.
Dynamics of the number of Linux users encountering exploits, Q1 2023—Q4 2024. The number of users who encountered exploits in Q1 2023 is taken as 100% (download)
For the Linux operating system, it is critically important to keep kernel components up to date, as well as any software used.
Most common published exploits
The distribution of published exploits for vulnerabilities by platform, Q3 2024 (download)
The distribution of published exploits for vulnerabilities by platform, Q4 2024 (download)
In Q4 2024, operating systems remained the most popular category of software in terms of the number of publicly available working exploits. At the same time, the share of exploits targeting Microsoft Office tools decreased, and no exploits for SharePoint vulnerabilities were published.
The distribution of published exploits for vulnerabilities by platform, 2024 (download)
Data for 2024 shows that the overall trend of attacks on operating systems continues to grow, increasingly displacing other categories of software. Researchers and attackers are finding new operating system components that still contain potentially exploitable vulnerabilities.
Vulnerability exploitation in APT attacks
We analyzed which vulnerabilities were most commonly used in APT attacks in Q4 2024. The ranking below is based on our telemetry, research, and open sources.
TOP 10 vulnerabilities exploited in APT attacks, Q4 2024 (download)
The list of vulnerabilities commonly used in APT attacks shows changes in the software exploited by attackers. Microsoft Office applications, whose vulnerabilities were not used as much in 2023, have returned to the top ten most frequently exploited types of software. In addition, vulnerabilities for PAN-OS appeared on the list for the first time. Moreover, remote access systems and corporate data processing solutions once again appeared among the vulnerable applications. These statistics highlight the issue of delayed patch installation, which attackers quickly exploit. We strongly recommend promptly updating the software listed.
Interesting vulnerabilities
This section contains the most interesting vulnerabilities published in Q4 2024.
CVE-2024-43572—Remote code execution vulnerability in Microsoft Management Console
The Windows operating system has many useful features and mechanisms that allow users to customize it for their convenience. One such feature is the Microsoft Management Console (MMC)—an interface for running applications that contain strictly structured information. These applications are called “snap-ins.” The operating system provides a number of built-in tools for working with MMC, such as services.msc—an interface for managing services. This is an XML file that interacts with individual COM objects and allows you to set parameters for them in the management console.
According to Microsoft documentation, .msc files can be used for system administration. Attackers exploited this functionality to run commands on user systems: inside the .msc file, they specified the URI urn:schemas-microsoft-com:xslt and commands in JavaScript and VBScript. These files were distributed as email attachments.
Header of the main .msc file
CVE-2024-43451—NetNTLM hash disclosure vulnerability
This vulnerability is also related to the functionality of the Windows operating system, specifically to the NTLM authentication mechanism with the SSPI interface, which is automatically launched in all versions of the OS up to and including Windows 10. During the transmission of the NetNTLM hash, an attacker can intercept it or redirect it to another service, resulting in the compromise of the victim’s credentials. In common legitimate Windows scenarios, users frequently need to authenticate using the NTLM protocol, which may attract attackers. In 2024, we observed the active use of files of various formats with the .url extension in attacks: these files contained links to resources that triggered authentication using NTLM mechanisms.
CVE-2024-49039—Elevation of privilege vulnerability in Windows Task Scheduler
Our 2024 reports mainly included vulnerabilities that were used either solely for privilege escalation or for initial system access. However, CVE-2024-49039 stands out because it allows stealthy persistence within the system, privilege escalation, and command execution.
This vulnerability exploits an undocumented RPC endpoint on the server side, which contains interfaces with a misconfigured security descriptor, enabling privilege escalation.
In recent versions of Windows, when a scheduled task is registered, applications can run in AppContainer, which generally limits their privileges. To exploit the vulnerability, an attacker needs to create a scheduled task that, upon execution, calls the undocumented RPC endpoint. The Task Scheduler contains a vulnerable application launch algorithm, and as a result of the RPC call, the application will be relaunched without AppContainer with the privileges of a regular or system user.
Conclusion and advice
The total number of vulnerabilities registered in the Q4 2024 continues to grow compared to 2023, but the number of published exploits decreased. This may be due to the fact that software vendors have not yet released patches because of the traditional lull during the holiday period. Notably, attackers continue to invent new methods of privilege escalation, as seen in the Task Scheduler vulnerability.
To stay safe, it is essential to respond promptly to the evolving threat landscape. Also, make sure that you:
- Ensure round-the-clock monitoring of your infrastructure, paying special attention to the perimeter;
- Maintain a patch management process: promptly apply security fixes. To configure and automate vulnerability and patch management, you can use solutions like Vulnerability Assessment and Patch Management and Kaspersky Vulnerability Data Feed;
- Use reliable solutions that can detect and block malware on corporate devices, and comprehensive tools that include incident response scenarios and up-to-date cyberthreat databases.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/vulnerabilities-and-exploits-in-q4-2024/115761/