cbcvebase.
CVE-2024-38196
published 2024-08-13

CVE-2024-38196: Windows Common Log File System Driver Elevation of Privilege Vulnerability

PriorityP278high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
5.72%
92.2th percentile
Windows Common Log File System Driver Elevation of Privilege Vulnerability

Affected

49 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.2075110.0.10240.20751
microsoftwindows_10_1607< 10.0.14393.725910.0.14393.7259
microsoftwindows_10_1809< 10.0.17763.618910.0.17763.6189
microsoftwindows_10_21h2< 10.0.19044.478010.0.19044.4780
microsoftwindows_10_22h2< 10.0.19045.478010.0.19045.4780
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.2075110.0.10240.20751
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.725910.0.14393.7259
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.618910.0.17763.6189
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.478010.0.19044.4780
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.478010.0.19045.4780
microsoftwindows_11_21h2< 10.0.22000.314710.0.22000.3147
microsoftwindows_11_22h2< 10.0.22621.403710.0.22621.4037
microsoftwindows_11_23h2< 10.0.22631.403710.0.22631.4037
microsoftwindows_11_24h2< 10.0.26100.145710.0.26100.1457
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.314710.0.22000.3147
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.403710.0.22621.4037
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.403710.0.22631.4037
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.403710.0.22631.4037
microsoftwindows_11_version_24h2>= 10.0.26100.0 < 10.0.26100.145710.0.26100.1457
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.272776.1.7601.27277
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.228256.0.6003.22825
microsoftwindows_server_2012< 6.2.9200.250316.2.9200.25031
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.250316.2.9200.25031

Detection & IOCsextracted from sources · hover to see the quote

hash5b0476043da365be5325260f1f0811ea81c018a8acc9cee4cd46cb7348c06fc6
hash05c6f53118d363ee80989ef37cad85ee1c35b0e22d5dcebd8a6d6a396a94cb65
domainves2owzq3uqyikb4zoeumzr4uxpi3twmy5qa5fdc4g7btpc43x5ahxyd.onion:9211
domaindf643p7juf4hhz3nqy4lychm2xslc645bozk3egqhsj46k6xqoy4xvad.onion:13201
domaind7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion:52295
domaind7qiqd6srhy4poo2q6vbn7bx4b2wl7nrclswfqprmldzuarbfz3rglid.onion:63185
domainyo2a27uulrkraxfdwfcx7zokonpsux5qlufqsu7ial45uitm5v2seyyd.onion:60939
domainoqki6m6qejavp7c5smafqa34locotxqbeh4scltzrhucgafykzzbh6ad.onion:1342
domainc5empmuptwtgmehonawb6pzd4ifupervyqduqpop2m3idsgbcwdtrdad.onion:53120
domainjsfnao46dnqos2avnrcvwlotr6xzqbp6uxfvl4mnkh6uyg6fch4bciqd.onion:56005
domainel4ccbgrbeyqdc4vn74tdtfstksdmwj66qdi7e77vucafwvvm7ozvgad.onion:6212
domaing7w5uxhxw5mp5jmshvevd273qvkph2if5xnvrjemthe6ok5q5dtek4ad.onion:58387
domaincunm2jbjumfxl6tfrtzkmpk7h722oxxqqfaw2iinkalt7ijf77ch27qd.onion:10192
domainr4gihskhiti437bonklmq24d6dl6swuw7zg5iseehjcepd3abbyyqsid.onion:62377
domainmh3ibr5n4abi3fr3rlaar7wr3p2ptjrcon3jcp6tuqxscxfii4pegkid.onion:24793
domainx76mtemtxl5fucgccu2nz4morfmpwwe44xp3ovkgsguzsntlh7ukn4id.onion:12656
domainxzxdiwnw354odly55y7twfrimzys5574eaw57ttetyyo4up5ww6v25ad.onion:20938
domainipatoez4ldch3vabmz6lcawxtoogkmg5alxvwdm7fwzng7flvlz47ryd.onion:45505
domainwlfeie2rk6utw3y5aykjisr3yj6c7hme43st2weo4jmtok6zxw33hyad.onion:31059
domain2fio6wjjlq4pihqf6qhefaqnkkfonkgbiu4uw3jvzhcuysejme4oxwyd.onion:6849
domainbpe2vrpvh5ri7odgbqxhr6mjaxe3zvekcexzdwpaiorq3xcbttrxywid.onion:22316
domain42lidqllkggf7tsgymwk4jzfmawdinwav5vkii3l3wsqcrk4k5ncrrad.onion:30971
domainvvftwyeaxr3f32t3etseadhvfx42ylza5g5gpg3zqp3e46tie2w34iyd.onion:13066
domain3c6vus267hplojma4d3qckohjgxnhattb2vkkwcm6anilylzqkzdakad.onion:48285
domainztnjv2hf4gxl7x7f27qhhfxehdd4cd6cdfwjw6u7njmqxjgllzm6kgid.onion:17249
domainokindaw6oogkyrdjghbqdcmbcrxersox5yphfod2uy363g5go72tx7qd.onion:37435
domainuxfjrthzy6c6a7d2zqk47x4ltjm6hmftbroghxk4vfjva6mftpsmkbyd.onion:49600
domain3gqcnr6wlxmv3dunl6rb4mcosa7ttedzbgya42burisj4qoeudl77nad.onion:40763
domainkykggujjvvag7p4nmptsfuyqrqtqiqqun3pimsuupecmpoez2gph4vqd.onion:34469
domaind4fsxtbvffjubsxmhczl6mt2wqukyao23vzi2dd7nahpcrwrhvkualid.onion:52210
domains54ui6ju3aa5w3anmo3lgwn53hm7us3lj5venw3eqyogoel6e6uv7fad.onion:14826
domain3rp2g7y5jyalwmihkagfvwdh3fjvbecor3vz4j6vwaxdnmi6onf2hrid.onion:24849
domainag2qts4t6fy6x475c5xuknlwdugdoy33oueejdv5lkfavah73g6mvlyd.onion:4853
domainqtnf675tghndtnnrosx2lsrvktbq7iw3noetckags2fb2ci7cujzxfyd.onion:20325
domain4l4abrrv5j7662dioqthd5fz5u4oxbpfradwt3ntliw2gfnikgers6qd.onion:35870
domainglhdxhgiqrboqrgw2dmwutpocyilxxuahxc6v3lfpfxhihahw4tjfeid.onion:4647
domaincsn3i3femv6dx362p4qesombr3e7gm5skcxkuqrymuaxeqqwmnrnvxyd.onion:13609
domainknvocjqt6znfp4lba3j237i5kjnxgmk6niqk72w3wb22bfif6i7wufad.onion:46367
domainyuuexutjzjmul7wldcecq6mpr2v5dyblw5n77elnoikttxfk3y54gnad.onion:20247
domainysbbw6ghpxos5jzcmdjydrrl3clqdvwfygejrktre4bixr3zo63vk7yd.onion:9080
  • Raspberry Robin exploits CVE-2024-38196 (Windows CLFS Driver improper input validation) to achieve local privilege escalation to SYSTEM; monitor for unusual CLFS driver interactions from non-privileged processes.
  • Raspberry Robin C2 communication uses ChaCha-20 encryption (migrated from AES-CTR); network traffic to .onion domains using ChaCha-20 framing with a 16-byte RC4 key (8-byte random seed appended to end) is indicative.
  • Raspberry Robin embeds intentionally corrupted TOR onion C2 domains that are dynamically corrected at runtime via a hardcoded per-sample algorithm; static extraction of C2 domains from the binary will yield invalid addresses.
  • Detect Raspberry Robin DLLs using the threat name Win32.Worm.RaspberryRobin in sandbox/AV telemetry.
  • CVE-2024-38196 exploitation grants SYSTEM privileges via the Windows Common Log File System Driver; monitor for privilege escalation events originating from the CLFS driver on unpatched systems.
  • ·RC4 key seed position and hardcoded key bytes vary per sample/campaign; the 8-byte random seed is now appended to the END of the 16-byte RC4 key (previously prepended). CRC-64 initial values are also randomized per sample/campaign, making static signature matching on these fields unreliable across campaigns.
  • ·The C2 domain correction algorithm is different per sample/campaign as of early 2025, meaning extracted onion domains from one sample cannot be directly applied to another without accounting for the per-sample correction routine.
  • ·Memory mapping offsets used for communication between Raspberry Robin's core module and TOR module vary per sample/campaign, complicating memory-based detection rules.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck7.8HIGH
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.