CVE-2024-38106
Microsoft Windows Kernel Privilege Escalation Vulnerability
Description
CVE-2024-38106 is a high-severity elevation of privilege vulnerability in the Windows Kernel with a CVSS v3.1 base score of 7.0. The flaw allows a locally authenticated attacker to escalate privileges to SYSTEM level, though exploitation requires winning a race condition (high attack complexity). CISA has added CVE-2024-38106 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 3, 2024, and the ransomware association remains classified as unknown. The EPSS score of 0.75% at the 72.9th percentile indicates moderate exploitation activity. The vulnerability affects a wide range of Windows versions including Windows 10, Windows 11, and Windows Server 2016 through 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20751 |
| microsoft | windows 10 1607 | < 10.0.14393.7259 |
| microsoft | windows 10 1809 | < 10.0.17763.6189 |
| microsoft | windows 10 21h2 | < 10.0.19044.4780 |
| microsoft | windows 10 22h2 | < 10.0.19045.4780 |
| microsoft | windows 11 21h2 | < 10.0.22000.3147 |
| microsoft | windows 11 22h2 | < 10.0.22621.4037 |
| microsoft | windows 11 23h2 | < 10.0.22631.4037 |
| microsoft | windows 11 24h2 | < 10.0.26100.1457 |
| microsoft | windows server 2016 | < 10.0.14393.7259 |
| microsoft | windows server 2019 | < 10.0.17763.6189 |
| microsoft | windows server 2022 | < 10.0.20348.2655 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1085 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38106(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38106(US Government Resource)
Weakness Type
Windows Kernel Elevation of Privilege
CVE-2024-38106 is an elevation of privilege vulnerability in the Windows Kernel itself, the core component of the operating system that manages system resources, memory, and process scheduling. The vulnerability stems from a race condition in the kernel's handling of certain operations, where concurrent access to shared kernel resources can lead to an inconsistent state that an attacker can exploit. Race conditions in kernel code are particularly dangerous because the kernel operates at the highest privilege level in the system. When an attacker successfully wins the race, they can manipulate kernel memory structures to redirect execution flow, ultimately gaining SYSTEM-level privileges from a low-privileged user context.
Impact Analysis
The business impact of CVE-2024-38106 is significant despite the high attack complexity requirement. Confidentiality is fully compromised upon successful exploitation, granting the attacker SYSTEM-level read access to all files, registry keys, credentials, and secrets on the affected system. This includes domain credentials cached on workstations, service account passwords, and encryption keys.
Integrity faces maximum impact because SYSTEM privileges allow modification of any system component, security policies, audit logs, and installed software. An attacker can install rootkits, disable security controls, and establish persistent backdoor access that survives reboots.
Availability is fully at risk as SYSTEM access enables the attacker to halt critical services, corrupt the operating system, deploy destructive payloads, or hold data for ransom. The high attack complexity (AC:H) requirement mitigates the risk somewhat, as the attacker must win a race condition, which may require multiple exploitation attempts. However, the confirmed active exploitation demonstrated by the KEV listing proves that real-world attackers have successfully weaponized this race condition. The EPSS score of 0.75% at the 72.9th percentile reflects moderate but meaningful exploitation activity in the threat landscape.
Exploit Maturity
CVE-2024-38106 has confirmed active exploitation as demonstrated by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of September 3, 2024. The EPSS score of 0.75% at the 72.9th percentile indicates that while exploitation is confirmed, the high attack complexity (race condition) limits the breadth of exploitation compared to simpler kernel vulnerabilities.
Microsoft has confirmed exploitation in the wild through its security advisory. The race condition requirement means exploitation is not guaranteed on every attempt, but sophisticated threat actors have demonstrated the ability to reliably trigger it in targeted attacks. The ransomware association is classified as unknown, meaning no direct link to ransomware campaigns has been confirmed by CISA, though kernel-level privilege escalation is a common component of advanced post-exploitation toolchains. Federal agencies bound by CISA's binding operational directive must remediate by the September 3, 2024 deadline.
Remediation
-
Apply the August 2024 Microsoft security updates immediately. Install the cumulative update from the Microsoft Security Response Center advisory. Ensure all affected systems are updated to the minimum patched build numbers, including Windows 10 22H2 (build 10.0.19045.4780 or later), Windows 11 23H2 (build 10.0.22631.4037 or later), and all affected Windows Server editions.
-
Prioritize domain controllers and high-value servers. Since the vulnerability is in the Windows Kernel, any system running an affected version is vulnerable. Focus patching efforts on domain controllers, database servers, and systems processing sensitive data, as SYSTEM-level compromise on these systems has the greatest organizational impact.
-
Restrict local logon access. CVE-2024-38106 requires local authentication (AV:L) with low privileges (PR:L). Limit which accounts can log on locally to servers and critical workstations by configuring User Rights Assignment policies. Remove unnecessary local accounts and enforce strong authentication for remote access.
-
Deploy endpoint detection and response monitoring. Configure EDR solutions to monitor for suspicious kernel-mode activity, including unusual system call patterns, unexpected process privilege escalation, and race condition exploitation indicators such as rapid thread creation and synchronization object manipulation.
-
Implement network segmentation and access controls. Reduce the blast radius of a successful exploitation by segmenting networks and limiting lateral movement capabilities. Ensure that compromised workstations cannot directly access critical servers or domain controllers without passing through monitored chokepoints.
Technical Details
CVE-2024-38106 carries a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, yielding a high base score of 7.0. The local attack vector (AV:L) requires authenticated access to the target system. The attack complexity is high (AC:H), which is the key differentiator from similar kernel vulnerabilities, indicating that exploitation depends on winning a race condition that is not trivially reproducible.
The vulnerability resides in the Windows Kernel's handling of concurrent operations on shared resources. A race condition occurs when two or more threads access shared kernel data structures simultaneously without proper synchronization. In this case, the kernel fails to adequately serialize access to a critical resource, creating a window where an attacker-controlled thread can modify kernel memory between the time it is validated and the time it is used (a time-of-check to time-of-use, or TOCTOU, pattern). By carefully timing thread execution and potentially using techniques such as heap spraying or pool grooming to control the kernel memory layout, the attacker can redirect kernel execution flow to achieve SYSTEM-level code execution. Low privileges (PR:L) are sufficient, meaning any standard user account can attempt the exploit. The scope is unchanged (S:U), confining impact to the vulnerable system. Affected versions include Windows 10 1507 through 22H2, Windows 11 21H2 through 24H2, and Windows Server 2016 through 2022 23H2.
Frequently Asked Questions
What is CVE-2024-38106?
CVE-2024-38106 is a high-severity elevation of privilege vulnerability in the Windows Kernel that allows a local attacker with low privileges to gain SYSTEM-level access through a race condition. It carries a CVSS v3.1 score of 7.0 and is actively exploited in the wild.
Why is the CVSS score 7.0 instead of 7.8 for this kernel vulnerability?
The lower score compared to similar kernel vulnerabilities is due to the high attack complexity (AC:H) rating. CVE-2024-38106 requires the attacker to win a race condition, which is not guaranteed on every attempt. This adds uncertainty to exploitation, reducing the base score from 7.8 (which would apply with low complexity) to 7.0.
Can CVE-2024-38106 be exploited remotely?
No, CVE-2024-38106 requires local access to the target system (AV:L). However, attackers typically combine local privilege escalation vulnerabilities with remote access techniques such as phishing, stolen VPN credentials, or other remote code execution flaws to create a complete attack chain.
Is CVE-2024-38106 linked to ransomware campaigns?
CISA currently lists the ransomware association as unknown. While no direct ransomware link has been confirmed, kernel-level privilege escalation vulnerabilities are frequently used in sophisticated attack chains that may include ransomware deployment as the final stage.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.