CVE-2024-21338
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Description
CVE-2024-21338 is a Windows Kernel Elevation of Privilege vulnerability affecting multiple versions of Microsoft Windows 10, Windows 11, and Windows Server. The vulnerability stems from an untrusted pointer dereference (CWE-822) in the Windows kernel, allowing a locally authenticated attacker to escalate their privileges to the SYSTEM level. An attacker who successfully exploits CVE-2024-21338 gains full control over the affected system, enabling them to install malware, tamper with data, or create persistent backdoors. This vulnerability has been confirmed by CISA as actively exploited in the wild and is linked to known ransomware campaigns, with a high EPSS score of 77.3% (98.9th percentile), making it a critical remediation priority.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1809 | < 10.0.17763.5458 |
| microsoft | windows 10 21h2 | < 10.0.19044.4046 |
| microsoft | windows 10 22h2 | < 10.0.19045.4046 |
| microsoft | windows 11 21h2 | < 10.0.22000.2777 |
| microsoft | windows 11 22h2 | < 10.0.22621.3155 |
| microsoft | windows 11 23h2 | < 10.0.22631.3155 |
| microsoft | windows server 2019 | < 10.0.17763.5458 |
| microsoft | windows server 2022 | < 10.0.20348.2322 |
| microsoft | windows server 2022 23h2 | <= 10.0.25398.709 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338(Patch, Vendor Advisory)
- https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/(Exploit, Technical Description, Third Party Advisory)
- https://packetstorm.news/files/id/190586/(Exploit, VDB Entry)
- https://www.exploit-db.com/exploits/52275(Exploit, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21338(US Government Resource)
Weakness Type
CWE-822: Untrusted Pointer Dereference
CWE-822 occurs when a program dereferences a pointer obtained from an untrusted source without verifying that it points to a valid memory region. In CVE-2024-21338, the Windows kernel dereferences a user-controlled pointer value, enabling an attacker with local access to redirect kernel execution to arbitrary memory addresses and gain elevated privileges.
Learn more: CWE-822 — Untrusted Pointer Dereference
Impact Analysis
CVE-2024-21338 carries a CVSS 3.1 score of 7.8 (HIGH) and requires only low-level local privileges to trigger — no network access and no user interaction are needed beyond what is already available to a limited user account. Confidentiality (High): A successful exploit exposes all data accessible to the SYSTEM account, including credentials and sensitive configuration. Integrity (High): The attacker can modify any file, registry key, or security policy on the system. Availability (High): Critical system processes can be terminated or the system can be crashed entirely. The EPSS score of 77.3% places this vulnerability in the top 1.1% of all CVEs for active exploitation likelihood, and CISA's KEV listing with a confirmed ransomware connection underscores the urgent real-world threat this vulnerability poses.
Exploit Maturity
CVE-2024-21338 has a well-documented and highly active exploit landscape. CISA has confirmed active exploitation of this vulnerability in the wild, and it has been attributed to the Lazarus Group, a state-sponsored threat actor, in connection with the FudModule rootkit — as detailed in a technical write-up by Avast. Public exploit code is available for CVE-2024-21338 via Packet Storm Security and Exploit-DB. The association with ransomware operations and the EPSS score of 77.3% (98.9th percentile) confirm that exploitation is widespread and ongoing — organizations should treat this as an emergency requiring immediate patching.
Remediation
- Apply the official Microsoft security update for CVE-2024-21338 immediately, per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338. CISA's required action states: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable."
- Prioritize patching across all affected versions: Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2.
- Restrict local logon access on sensitive systems — apply the principle of least privilege to limit the impact of any low-privileged attacker gaining a foothold.
- Deploy endpoint detection and response (EDR) tools configured to detect kernel-level anomalies, such as unusual SYSTEM process spawning or driver loading from untrusted paths. Review event logs for signs of privilege escalation (e.g., Event IDs 4672, 4673, 4624 with elevated tokens).
- Given the confirmed association with the FudModule rootkit and state-sponsored threat actors, conduct a thorough forensic review of affected systems for signs of persistent compromise, including hidden drivers and rootkit artifacts.
Technical Details
CVE-2024-21338 is rooted in an untrusted pointer dereference (CWE-822) within the Windows kernel. The vulnerability arises when the kernel processes a user-supplied pointer value without first validating that the pointer refers to a legitimate kernel memory region, allowing the attacker to redirect execution flow to an attacker-controlled address. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms local exploitation with low attack complexity and no user interaction required beyond holding a standard user account. Attackers leveraging this flaw can overwrite kernel data structures to escalate to SYSTEM, a technique actively used by the Lazarus Group's FudModule rootkit to maintain kernel-level persistence while evading detection. The scope is unchanged (S:U), meaning the impact is confined to the Windows kernel itself, but at that privilege level all security boundaries on the system are effectively bypassed.
Frequently Asked Questions
Is CVE-2024-21338 being actively exploited?
Yes. CISA has listed CVE-2024-21338 in its Known Exploited Vulnerabilities (KEV) catalog and confirmed active exploitation in the wild. The vulnerability has been linked to ransomware campaigns and attributed to the Lazarus Group, a state-sponsored threat actor. The EPSS score of 77.3% (98.9th percentile) further confirms ongoing exploitation.
What products are affected by CVE-2024-21338?
CVE-2024-21338 affects multiple Microsoft Windows versions: Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 21H2, 22H2, 23H2), Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2. Organizations running any of these platforms without the relevant security update are at risk.
How do I fix CVE-2024-21338?
Apply the Microsoft security patch for CVE-2024-21338 available through Windows Update or the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338. Prioritize all affected Windows 10, Windows 11, and Windows Server systems. After patching, review systems for signs of prior compromise, particularly kernel-level rootkit artifacts.
How severe is CVE-2024-21338?
CVE-2024-21338 is rated HIGH with a CVSS 3.1 score of 7.8, reflecting full confidentiality, integrity, and availability impact upon successful exploitation. The EPSS score of 77.3% places it in the 98.9th percentile, meaning it is among the most actively exploited vulnerabilities currently tracked. Combined with confirmed ransomware usage and state-actor attribution, this vulnerability demands immediate attention.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.