7.8 CVE-2024-21338

CISA Kev Catalog Patch Exploit
 

Windows Kernel Elevation of Privilege Vulnerability
https://nvd.nist.gov/vuln/detail/CVE-2024-21338

Categories

CWE-822 : Untrusted Pointer Dereference
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer. message-passing framework interprets values in packets as pointers, causing a crash. labeled as a "type confusion" issue, also referred to as a "stale pointer." However, the bug ID says "contents are simply interpreted as a pointer... renderer ordinarily doesn't supply this pointer directly". The "handle" in the untrusted area is replaced in one function, but not another - thus also, effectively, exposure to wrong sphere (CWE-668). Untrusted dereference using undocumented constructor. An error code is incorrectly checked and interpreted as a pointer, leading to a crash. An untrusted value is obtained from a packet and directly called as a function pointer, leading to code execution. Undocumented attribute in multimedia software allows "unmarshaling" of an untrusted pointer. ActiveX control for security software accepts a parameter that is assumed to be an initialized pointer. Spreadsheet software treats certain record values that lead to "user-controlled pointer" (might be untrusted offset, not untrusted pointer).

CWE-NVD-noinfo

References

https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond...
Exploit Technical Description Third Party Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338
Patch Vendor Advisory


 

CPE

cpe start end
Configuration 1
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* < 10.0.17763.5458
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* < 10.0.19044.4046
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* < 10.0.19045.4046
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* < 10.0.22000.2777
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* < 10.0.22621.3155
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* < 10.0.22631.3155
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* < 10.0.17763.5458
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* < 10.0.20348.2322
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* <= 10.0.25398.709

REMEDIATION

Patch

Url
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338

EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
https://github.com/varwara/CVE-2024-21338

Other Nist (github, ...)

Url
https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond...

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
129 Pointer Manipulation
Medium