CVE-2024-30088
Microsoft Windows Kernel TOCTOU Race Condition Vulnerability
Description
CVE-2024-30088 is a high-severity elevation of privilege vulnerability in the Windows Kernel that allows an authenticated local attacker to escalate privileges to SYSTEM level. The flaw affects a wide range of Windows versions including Windows 10 (multiple builds), Windows 11 21H2 through 23H2, and Windows Server 2016 through 2022 23H2. With a CVSS v3.1 base score of 7.0 (HIGH) and a known ransomware association, this vulnerability is actively used by threat actors as a post-compromise privilege escalation tool. CISA added CVE-2024-30088 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 85.35% at the 99.3rd percentile confirms widespread exploitation across the Windows ecosystem.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20680 |
| microsoft | windows 10 1607 | < 10.0.14393.7070 |
| microsoft | windows 10 1809 | < 10.0.17763.5936 |
| microsoft | windows 10 21h2 | < 10.0.19044.4529 |
| microsoft | windows 10 22h2 | < 10.0.19045.4529 |
| microsoft | windows 11 21h2 | < 10.0.22000.3019 |
| microsoft | windows 11 22h2 | < 10.0.22621.3737 |
| microsoft | windows 11 23h2 | < 10.0.22631.3737 |
| microsoft | windows server 2016 | < 10.0.14393.7070 |
| microsoft | windows server 2019 | < 10.0.17763.5936 |
| microsoft | windows server 2022 | < 10.0.20348.2522 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.950 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-30088(US Government Resource)
Weakness Type
Unspecified Weakness (Windows Kernel Privilege Escalation)
Microsoft has not disclosed the specific CWE classification for CVE-2024-30088. Based on the vulnerability characteristics, it involves a race condition or improper validation in the Windows Kernel that allows a locally authenticated attacker to escalate privileges. Kernel privilege escalation vulnerabilities typically exploit flaws in system call handlers, object managers, or driver interfaces where insufficient validation allows manipulation of kernel data structures to gain SYSTEM-level privileges.
Learn more: Microsoft Security Advisory for CVE-2024-30088
Impact Analysis
The impact of CVE-2024-30088 covers all three security pillars, with Confidentiality (High), Integrity (High), and Availability (High) fully compromised upon successful exploitation. The attack requires local access (AV:L) with high complexity (AC:H) and low privileges (PR:L), but no user interaction (UI:N). The high attack complexity reflects the race condition nature of the exploit, which may not succeed on every attempt but is highly reliable with repeated execution. Despite the local access requirement, this vulnerability is extremely valuable to attackers who have already gained initial access through other means, as it provides the critical privilege escalation step from a limited user account to full SYSTEM control. The confirmed ransomware nexus (Ransomware=Known) demonstrates that ransomware operators actively chain this vulnerability with initial access exploits to achieve the elevated privileges needed for domain-wide deployment. The EPSS score of 85.35% at the 99.3rd percentile indicates extensive exploitation. The breadth of affected Windows versions, spanning desktop and server platforms from Windows 10 1507 through Windows Server 2022 23H2, means virtually every Windows environment is potentially affected.
Exploit Maturity
CVE-2024-30088 has reached advanced exploit maturity with confirmed exploitation by multiple threat groups. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 5, 2024, and tagged it with a known ransomware nexus. The EPSS score of 85.35% at the 99.3rd percentile places it among the most actively exploited Windows kernel vulnerabilities of 2024. Microsoft published the patch in the June 2024 Patch Tuesday advisory. The vulnerability has been attributed to exploitation by APT groups and ransomware operators who use it as a post-initial-access privilege escalation primitive. The race condition-based exploit has been refined and weaponized, with reliable exploitation techniques circulating among threat actors. Windows kernel privilege escalation vulnerabilities are consistently among the most valuable exploit targets, as they provide the SYSTEM-level access required for credential dumping, security tool evasion, and lateral movement in enterprise environments.
Remediation
-
Apply the June 2024 Windows security updates immediately from the Microsoft Security Response Center advisory. The patch addresses the kernel privilege escalation across all affected Windows versions including Windows 10, Windows 11, and Windows Server editions.
-
Prioritize patching systems with known exposure to initial access vectors, as CVE-2024-30088 is primarily used as a privilege escalation step after attackers have already gained a foothold. Focus on internet-facing servers, VPN endpoints, remote desktop hosts, and systems with known unpatched remote vulnerabilities.
-
Enable and monitor Windows Credential Guard and Virtualization-Based Security (VBS) where supported, as these hardware-backed security features can limit the impact of kernel-level privilege escalation by protecting credentials and critical system memory even when SYSTEM access is obtained.
-
Implement application control policies using Windows Defender Application Control (WDAC) or AppLocker to prevent unauthorized executables from running. Kernel exploits typically require running attacker-supplied code, and strict application control can block the exploit payload even if the initial access is successful.
-
Deploy enhanced kernel telemetry and monitoring by enabling Windows Kernel Audit logging, configuring Sysmon for kernel-level event capture, and ensuring EDR solutions are monitoring for privilege escalation indicators such as token manipulation, unexpected SYSTEM processes spawned from user-level parent processes, and race condition exploitation patterns.
Technical Details
CVE-2024-30088 is a Windows Kernel elevation of privilege vulnerability. The CVSS v3.1 vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a local access (AV:L) attack with high complexity (AC:H) requiring low privileges (PR:L) and no user interaction (UI:N), with Unchanged scope (S:U) and maximum impact across confidentiality, integrity, and availability. The local attack vector (AV:L) means the attacker must already have code execution on the target system, typically through an initial access vulnerability or social engineering. The high attack complexity (AC:H) indicates the exploit relies on a race condition in the Windows Kernel, where the attacker must win a timing race between concurrent kernel operations. The low privilege requirement (PR:L) means any authenticated user can attempt the exploit. The vulnerability likely resides in a kernel system call handler or object manager operation where a TOCTOU (time-of-check-time-of-use) race condition allows an attacker to modify kernel data structures between validation and use. By repeatedly triggering the race condition, the attacker can corrupt kernel memory in a controlled manner, typically modifying process token structures to elevate the current process to SYSTEM privileges. The affected version matrix spans Windows 10 builds from 10.0.10240 through Windows Server 2022 23H2 build 10.0.25398, representing virtually the entire actively supported Windows ecosystem.
Frequently Asked Questions
Is CVE-2024-30088 being actively exploited?
Yes, CISA confirmed active exploitation and added CVE-2024-30088 to the Known Exploited Vulnerabilities catalog. The vulnerability has a known ransomware association, and the EPSS score of 85.35% at the 99.3rd percentile confirms widespread exploitation by threat actors as a privilege escalation tool.
What products are affected by CVE-2024-30088?
Windows 10 (versions 1507 through 22H2), Windows 11 (21H2 through 23H2), Windows Server 2016, 2019, 2022, and Windows Server 2022 23H2 are all affected. This covers virtually every actively supported Windows operating system version.
How do I fix CVE-2024-30088?
Install the June 2024 Windows security updates from Microsoft. Prioritize patching systems that are most exposed to initial access vectors, enable Credential Guard and VBS where supported, and implement application control policies to block exploit payloads.
Why is a local privilege escalation vulnerability dangerous if it requires initial access?
Local privilege escalation vulnerabilities like CVE-2024-30088 are critical components in attack chains. Attackers first gain limited access through phishing, unpatched services, or stolen credentials, then use privilege escalation to achieve SYSTEM-level control. This elevated access enables credential dumping, security tool evasion, lateral movement, and domain-wide ransomware deployment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.