cbcvebase.
CVE-2024-21338
published 2024-02-13

CVE-2024-21338: Windows Kernel Elevation of Privilege Vulnerability

PriorityP188high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2024-03-25
Exploited in the wild
EPSS
51.87%
98.8th percentile
Windows Kernel Elevation of Privilege Vulnerability

Affected

37 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1809< 10.0.17763.545810.0.17763.5458
microsoftwindows_10_21h2< 10.0.19044.404610.0.19044.4046
microsoftwindows_10_22h2< 10.0.19045.404610.0.19045.4046
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.545810.0.17763.5458
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.545810.0.17763.5458
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.404610.0.19044.4046
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.404610.0.19045.4046
microsoftwindows_11_21h2< 10.0.22000.277710.0.22000.2777
microsoftwindows_11_22h2< 10.0.22621.315510.0.22621.3155
microsoftwindows_11_23h2< 10.0.22631.315510.0.22631.3155
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.277710.0.22000.2777
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.315510.0.22621.3155
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.315510.0.22631.3155
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.315510.0.22631.3155
microsoftwindows_server_2019< 10.0.17763.545810.0.17763.5458
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.545810.0.17763.5458
microsoftwindows_server_2022< 10.0.20348.232210.0.20348.2322
microsoftwindows_server_2022>= 10.0.20348.0 < 10.0.20348.232210.0.20348.2322
microsoftwindows_server_2022_23h2<= 10.0.25398.709
msrcwindows_10_version_1809_for_32-bit_systems
msrcwindows_10_version_1809_for_arm64-based_systems
msrcwindows_10_version_1809_for_x64-based_systems
msrcwindows_10_version_21h2_for_32-bit_systems
msrcwindows_10_version_21h2_for_arm64-based_systems
msrcwindows_10_version_21h2_for_x64-based_systems

Detection & IOCsextracted from sources · hover to see the quote

pathappid.sys
ip185.73.125.6
hashd46fbc4a57dce813574ee312001eaad0aa4e52de
yara
rule signed_driver_64bit { meta: description = "Detects 64-bit signed drivers" author = "Jiri Vinopal @ Check Point Research" condition: uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and uint16(uint32(0x3C) + 0x5c) == 0x0001 and uint16(uint32(0x3C) + 0x18) == 0x020b and }
  • Monitor for IOCTL requests targeting the appid.sys kernel driver (Windows AppLocker driver); malicious exploitation involves a specially crafted IOCTL that causes kernel-mode code execution.
  • Alert on processes spawned with SYSTEM privileges from user-level parent processes, especially following interaction with appid.sys.
  • Detect unexpected termination or disabling of security services (AV/EDR) such as AhnLab V3, Windows Defender, CrowdStrike Falcon, and HitmanPro following privilege escalation activity.
  • Hunt for FudModule rootkit activity performing direct kernel object manipulation (DKOM), which is the post-exploitation payload delivered after CVE-2024-21338 exploitation by Lazarus Group.
  • Monitor for attempts to tamper with PPL (Protected Process Light) protected processes or lsass after a privilege escalation event, as kernel access enables PPL bypass and credential dumping.
  • Correlate CVE-2024-21338 exploitation attempts with Lazarus Group TTPs; the group exploited this as a zero-day from at least August 2023 through February 2024 patch.
  • Check driver DACL/SDDL to identify if appid.sys device object is accessible by non-privileged users, which is the prerequisite for exploitation of this vulnerability class.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck7.8HIGH
cisa7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.