CVE-2024-35250
Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability
Description
CVE-2024-35250 is a high-severity elevation of privilege vulnerability in the Windows Kernel-Mode Driver affecting virtually all supported versions of Windows, including Windows 10, Windows 11, and Windows Server editions from 2008 through 2022. A local attacker with low-level privileges can exploit this flaw to gain SYSTEM-level access on the affected machine. With a CVSS v3.1 base score of 7.8 and an EPSS score of 53.69% at the 97.9th percentile, this vulnerability is heavily targeted in post-exploitation scenarios. CISA has added CVE-2024-35250 to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 6, 2025, confirming active exploitation in real-world attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20680 |
| microsoft | windows 10 1607 | < 10.0.14393.7070 |
| microsoft | windows 10 1809 | < 10.0.17763.5936 |
| microsoft | windows 10 21h2 | < 10.0.19044.4529 |
| microsoft | windows 10 22h2 | < 10.0.19045.4529 |
| microsoft | windows 11 21h2 | < 10.0.22000.3019 |
| microsoft | windows 11 22h2 | < 10.0.22621.3737 |
| microsoft | windows 11 23h2 | < 10.0.22631.3737 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7070 |
| microsoft | windows server 2019 | < 10.0.17763.5936 |
| microsoft | windows server 2022 | < 10.0.20348.2522 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.950 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35250(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-35250(US Government Resource)
Weakness Type
Windows Kernel-Mode Driver Privilege Escalation
CVE-2024-35250 is an elevation of privilege vulnerability in the Windows kernel-mode driver subsystem. Kernel-mode drivers operate at the highest privilege level in the Windows operating system, managing hardware interactions, memory operations, and system-level functions. A vulnerability in this component allows a local attacker to escalate from a standard user context to SYSTEM privileges, the highest privilege level on a Windows machine. The specific weakness involves improper handling of certain operations within the kernel-mode driver, enabling an attacker to manipulate kernel memory or execution flow to achieve privilege escalation. This class of vulnerability is particularly dangerous because kernel-level exploits bypass all user-mode security controls including User Account Control (UAC), application sandboxes, and access control lists.
Impact Analysis
The impact of CVE-2024-35250 is rated High across confidentiality, integrity, and availability, with the critical distinction that successful exploitation grants SYSTEM-level privileges. Confidentiality is fully compromised because SYSTEM access allows reading any file on the system, extracting credentials from memory (including those protected by LSASS), accessing encrypted data stores, and reading the contents of any user's files regardless of access controls.
Integrity faces maximum impact as SYSTEM privileges enable modification of any system file, installation of rootkits or persistent backdoors, manipulation of security logs, alteration of Group Policy settings, and creation of new administrative accounts. An attacker at SYSTEM level can effectively rewrite the security posture of the entire machine.
Availability is highly impacted because SYSTEM access allows the attacker to disable security software, stop critical services, corrupt the operating system, or render the machine inoperable. The attack requires local access (AV:L), low complexity (AC:L), and only low-level privileges (PR:L) to execute, with no user interaction needed (UI:N). The EPSS score of 53.69% at the 97.9th percentile indicates extremely high exploitation probability. The scope of affected systems is enormous, spanning every supported Windows version from Server 2008 through the latest Windows 11 23H2, making this one of the most broadly impactful Windows privilege escalation vulnerabilities. While CISA lists the ransomware association as unknown, local privilege escalation is a standard component of ransomware kill chains, used to disable security tools and maximize encryption scope.
Exploit Maturity
CVE-2024-35250 has high exploit maturity, confirmed by CISA's inclusion in the Known Exploited Vulnerabilities catalog with active exploitation status. The EPSS score of 53.69% at the 97.9th percentile places it among the top 2.1% of all vulnerabilities in terms of exploitation probability.
The Microsoft Security Response Center advisory provides the official vulnerability details and patch information. Kernel-mode driver vulnerabilities are highly valued by both offensive security researchers and threat actors because they provide the most powerful form of privilege escalation on Windows systems. The broad version scope, affecting every supported Windows edition, maximizes the number of potential targets. While CISA lists the ransomware association as unknown, local privilege escalation vulnerabilities are routinely incorporated into ransomware attack chains as a post-initial-access step. The vulnerability is particularly attractive for lateral movement scenarios where an attacker has gained initial access with limited privileges and needs SYSTEM access to deploy payloads, disable endpoint detection, or extract domain credentials.
Remediation
-
Apply Microsoft security updates immediately. Install the June 2024 cumulative updates for all affected Windows versions. The specific KB articles vary by Windows version: Windows 10 versions require updates bringing them to the fixed build numbers listed in the Microsoft advisory, Windows 11 requires updates to 22000.3019, 22621.3737, or 22631.3737 respectively, and all Windows Server editions from 2008 through 2022 23H2 require their corresponding updates. Use Microsoft's advisory for version-specific patch details.
-
Prioritize patching based on exposure and role. Focus first on systems that are most likely to face exploitation: internet-facing servers, systems in DMZ networks, workstations with remote access enabled, and any system where users have interactive login access. Domain controllers and other infrastructure servers should also receive priority patches.
-
Implement endpoint detection monitoring. Deploy or verify that endpoint detection and response (EDR) solutions are actively monitoring for kernel exploitation indicators, including unusual kernel-mode driver loading, suspicious memory operations, and unexpected privilege escalation from low-privilege processes. Enable additional logging for process creation events and privilege changes.
-
Enforce principle of least privilege. Review and restrict user permissions across the environment. Since the vulnerability requires low-level local access, reducing the number of users with interactive login access to servers and workstations limits the pool of potential starting points for exploitation.
-
Assess post-exploitation risk. If systems were unpatched and accessible to users during the vulnerability window, investigate for signs of privilege escalation abuse. Check for new administrative accounts, modified security configurations, disabled security software, and evidence of credential harvesting tools such as Mimikatz that leverage SYSTEM-level access.
Technical Details
CVE-2024-35250 is a Windows Kernel-Mode Driver Elevation of Privilege vulnerability. The CVSS v3.1 vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector with low complexity, low privilege requirement, no user interaction needed, and high impact across all CIA dimensions.
The vulnerability exists in the Windows kernel-mode driver subsystem, a fundamental component of the Windows operating system that manages hardware abstraction, device communication, and low-level system operations. Kernel-mode drivers execute at ring 0, the highest privilege level in the x86/x64 architecture, with direct access to all hardware and memory.
The attack mechanism involves a local attacker running a specially crafted application that triggers the vulnerability in the kernel-mode driver. The flaw allows the attacker to manipulate kernel execution in a way that elevates their process privileges from the initial low-level user context to SYSTEM, which is the highest privilege account on Windows. SYSTEM privileges exceed even those of local administrators, providing unrestricted access to all system resources.
The breadth of affected systems is exceptional. Vulnerable versions include Windows 10 versions 1507, 1607, 1809, 21H2, and 22H2; Windows 11 versions 21H2, 22H2, and 23H2; and Windows Server 2008 (including R2), 2012 (including R2), 2016, 2019, 2022, and 2022 23H2. Each version has a specific fixed build number, with the patches included in the June 2024 security updates. The universal impact across Windows versions indicates the vulnerable code path exists in a core driver component shared across the entire Windows product line.
Frequently Asked Questions
What is CVE-2024-35250?
CVE-2024-35250 is an elevation of privilege vulnerability in the Windows Kernel-Mode Driver that allows a local attacker with low-level user privileges to escalate to SYSTEM-level access. It affects virtually all supported versions of Windows including Windows 10, 11, and Server editions.
How severe is CVE-2024-35250?
With a CVSS score of 7.8 (High) and an EPSS score of 53.69% at the 97.9th percentile, this is one of the most actively exploited Windows privilege escalation vulnerabilities. CISA has confirmed active exploitation and set a remediation deadline of January 6, 2025.
Can this vulnerability be exploited remotely?
No. CVE-2024-35250 requires local access to the target system (AV:L). However, it is commonly used in attack chains where an adversary has already gained initial remote access through another vulnerability or phishing, then uses this flaw to escalate privileges locally.
Which Windows versions are affected?
Virtually all supported Windows versions are affected: Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), and Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2. Microsoft released patches in the June 2024 security updates.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.