7.8 CVE-2024-21338

Enriched by CISA CISA Kev Catalog Patch Exploit
 

Windows Kernel Elevation of Privilege Vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2024-21338

Categories

CWE-822 : Untrusted Pointer Dereference
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) Use tools that are integrated duringcompilation to insert runtime error-checking mechanismsrelated to memory safety errors, such as AddressSanitizer(ASan) for C/C++ [REF-1518]. message-passing framework interprets values in packets as pointers, causing a crash. labeled as a "type confusion" issue, also referred to as a "stale pointer." However, the bug ID says "contents are simply interpreted as a pointer... renderer ordinarily doesn't supply this pointer directly". The "handle" in the untrusted area is replaced in one function, but not another - thus also, effectively, exposure to wrong sphere (CWE-668). Untrusted dereference using undocumented constructor. An error code is incorrectly checked and interpreted as a pointer, leading to a crash. An untrusted value is obtained from a packet and directly called as a function pointer, leading to code execution. Undocumented attribute in multimedia software allows "unmarshaling" of an untrusted pointer. ActiveX control for security software accepts a parameter that is assumed to be an initialized pointer. Spreadsheet software treats certain record values that lead to "user-controlled pointer" (might be untrusted offset, not untrusted pointer).

CWE-NVD-noinfo

References

134c704f-9b21-4f2e-91b3-4a467353bcc0

af854a3a-2127-422b-91ae-364da2661108 Patch Exploit

secure@microsoft.com Patch Exploit


 

AFFECTED (from MITRE)

Vendor Product Versions
Microsoft Windows 10 Version 1809
  • 10.0.17763.0 < 10.0.17763.5458 [affected]
Microsoft Windows 10 Version 1809
  • 10.0.0 < 10.0.17763.5458 [affected]
Microsoft Windows Server 2019
  • 10.0.17763.0 < 10.0.17763.5458 [affected]
Microsoft Windows Server 2019 (Server Core installation)
  • 10.0.17763.0 < 10.0.17763.5458 [affected]
Microsoft Windows Server 2022
  • 10.0.20348.0 < 10.0.20348.2322 [affected]
Microsoft Windows 11 version 21H2
  • 10.0.0 < 10.0.22000.2777 [affected]
Microsoft Windows 10 Version 21H2
  • 10.0.19043.0 < 10.0.19044.4046 [affected]
Microsoft Windows 11 version 22H2
  • 10.0.22621.0 < 10.0.22621.3155 [affected]
Microsoft Windows 10 Version 22H2
  • 10.0.19045.0 < 10.0.19045.4046 [affected]
Microsoft Windows 11 version 22H3
  • 10.0.22631.0 < 10.0.22631.3155 [affected]
Microsoft Windows 11 Version 23H2
  • 10.0.22631.0 < 10.0.22631.3155 [affected]
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
  • 10.0.25398.0 < 10.0.25398.709 [affected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe start end
Configuration 1
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* < 10.0.17763.5458
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* < 10.0.19044.4046
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* < 10.0.19045.4046
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* < 10.0.22000.2777
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* < 10.0.22621.3155
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* < 10.0.22631.3155
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* < 10.0.17763.5458
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* < 10.0.20348.2322
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* <= 10.0.25398.709

REMEDIATION

Patch

Url
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338

EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
https://github.com/varwara/CVE-2024-21338

Other Nist (github, ...)

Url
https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond...
https://packetstorm.news/files/id/190586/
https://www.exploit-db.com/exploits/52275

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
129 Pointer Manipulation
Medium