CVE-2024-38107
Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability
Description
CVE-2024-38107 is a high-severity elevation of privilege vulnerability in the Windows Power Dependency Coordinator component, carrying a CVSS v3.1 base score of 7.8. The flaw allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access by exploiting a use-after-free or similar memory safety issue within the Power Dependency Coordinator service. CISA has added CVE-2024-38107 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 3, 2024, and its ransomware association is currently classified as unknown. With an EPSS score of 3.35% at the 87.1st percentile, this vulnerability demonstrates significant real-world exploitation interest. The vulnerability affects a broad range of Microsoft Windows versions including Windows 10, Windows 11, Windows Server 2012 through 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20751 |
| microsoft | windows 10 1607 | < 10.0.14393.7259 |
| microsoft | windows 10 1809 | < 10.0.17763.6189 |
| microsoft | windows 10 21h2 | < 10.0.19044.4780 |
| microsoft | windows 10 22h2 | < 10.0.19045.4780 |
| microsoft | windows 11 21h2 | < 10.0.22000.3147 |
| microsoft | windows 11 22h2 | < 10.0.22621.4037 |
| microsoft | windows 11 23h2 | < 10.0.22631.4037 |
| microsoft | windows 11 24h2 | < 10.0.26100.1457 |
| microsoft | windows server 2012 | < 6.2.9200.25031; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7259 |
| microsoft | windows server 2019 | < 10.0.17763.6189 |
| microsoft | windows server 2022 | < 10.0.20348.2655 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1085 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38107(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38107(US Government Resource)
Weakness Type
Elevation of Privilege in Windows Power Dependency Coordinator
CVE-2024-38107 targets the Windows Power Dependency Coordinator, a system-level service responsible for managing power dependency relationships between components in the Windows operating system. The vulnerability allows a locally authenticated user with low privileges to execute code with elevated privileges, effectively gaining SYSTEM-level access. Power management subsystems operate at a high privilege level because they must coordinate hardware and software power states across the entire system. When a memory safety flaw exists in such a privileged service, it creates a direct path from user-level code to kernel or SYSTEM-level execution. Elevation of privilege vulnerabilities in core Windows components are particularly dangerous because they can be chained with initial access vectors such as phishing or remote code execution to achieve full system compromise.
Impact Analysis
The business impact of CVE-2024-38107 is severe, with maximum ratings across confidentiality, integrity, and availability. Confidentiality is fully compromised because SYSTEM-level access grants the attacker the ability to read any file, credential, or secret stored on the affected system, including SAM databases, cached domain credentials, DPAPI-protected data, and any application secrets.
Integrity faces maximum impact as the attacker can modify any system file, install persistent backdoors, tamper with security software, alter event logs to cover tracks, and inject malicious code into other processes or services. SYSTEM privileges also enable the attacker to create new administrator accounts and modify group policies on domain-joined systems.
Availability is fully at risk since the attacker can disable critical services, corrupt the operating system, deploy ransomware, or render the system completely inoperable. The local attack vector (AV:L) means the attacker needs an initial foothold on the system, but the low complexity (AC:L) and no user interaction (UI:N) requirements make exploitation straightforward once initial access is achieved. The EPSS score of 3.35% at the 87.1st percentile indicates active exploitation interest, and the KEV listing confirms real-world attacks are occurring.
Exploit Maturity
CVE-2024-38107 has confirmed active exploitation, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of September 3, 2024. The EPSS score of 3.35% at the 87.1st percentile places it well above the median for exploited vulnerabilities, indicating significant threat actor interest and active weaponization.
Microsoft has acknowledged exploitation in the wild through its security advisory, which confirms the vulnerability was being exploited prior to the availability of the patch. The ransomware association is currently classified as unknown, meaning CISA has not yet confirmed direct use in ransomware campaigns, though the SYSTEM-level privilege escalation capability makes it a highly attractive component for post-exploitation frameworks and ransomware toolchains. Federal agencies and organizations following CISA's binding operational directive are required to patch by the September 3, 2024 deadline.
Remediation
-
Apply the August 2024 Microsoft security updates immediately. Install the cumulative update from the Microsoft Security Response Center advisory that addresses CVE-2024-38107. Ensure all affected Windows versions are updated to the minimum patched build numbers, including Windows 10 (build 10.0.19045.4780 or later for 22H2), Windows 11 (build 10.0.22631.4037 or later for 23H2), and all affected Windows Server editions.
-
Prioritize patching based on exposure and criticality. Systems that are internet-facing, handle sensitive data, or are used as jump servers should receive the patch first. Domain controllers and administrative workstations are high-priority targets because SYSTEM-level compromise on these machines has cascading effects across the entire Active Directory environment.
-
Implement the principle of least privilege. Ensure users and service accounts operate with the minimum necessary permissions. Since the vulnerability requires local authenticated access with low privileges (PR:L), reducing the number of accounts with local login capabilities limits the attack surface.
-
Monitor for indicators of compromise. Review security logs for unusual process creation events from the Power Dependency Coordinator service, unexpected privilege escalation patterns, and anomalous SYSTEM-level process activity. Deploy endpoint detection and response (EDR) solutions to detect post-exploitation behavior.
-
Audit and harden local access paths. Review remote access solutions (RDP, VPN, remote management tools) to ensure they are properly secured and monitored, as these represent the most common paths attackers use to gain the initial local access required to exploit this vulnerability.
Technical Details
CVE-2024-38107 carries a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, resulting in a high base score of 7.8. The attack vector is local (AV:L), meaning the attacker must have authenticated access to the target system. The attack complexity is low (AC:L), indicating the exploit is reliable and does not depend on race conditions or unusual system configurations. Low privileges (PR:L) are required, meaning any standard user account can trigger the vulnerability. No user interaction (UI:N) is needed beyond the attacker's own actions.
The vulnerability resides in the Windows Power Dependency Coordinator (PDC), a kernel-mode component that manages power state dependencies between system components. The flaw involves improper handling of memory objects within the PDC service, where a reference to a freed memory object can be reused under specific conditions. By carefully manipulating the timing and sequence of power dependency operations, an attacker can cause the system to operate on freed memory, redirecting execution flow to attacker-controlled code running with SYSTEM privileges. The scope remains unchanged (S:U), meaning the impact is confined to the vulnerable system itself, but SYSTEM-level access effectively grants complete control over the affected machine. The vulnerability spans Windows 10 builds from 1507 through 22H2, all Windows 11 builds including 24H2, and Windows Server 2012 through Server 2022 23H2.
Frequently Asked Questions
What is CVE-2024-38107?
CVE-2024-38107 is a high-severity elevation of privilege vulnerability in the Windows Power Dependency Coordinator that allows a local attacker with low privileges to gain SYSTEM-level access. It has a CVSS v3.1 score of 7.8 and is actively exploited in the wild.
Which Windows versions are affected by CVE-2024-38107?
The vulnerability affects nearly all supported Windows versions, including Windows 10 (versions 1507 through 22H2), Windows 11 (versions 21H2 through 24H2), and Windows Server 2012, 2016, 2019, 2022, and 2022 23H2. Both desktop and server editions require patching.
Can CVE-2024-38107 be exploited remotely?
No, CVE-2024-38107 requires local access to the target system (AV:L). However, it is commonly chained with remote access vulnerabilities or social engineering attacks. An attacker who gains initial access through phishing or another remote vector can then use this vulnerability to escalate privileges to SYSTEM.
Is CVE-2024-38107 linked to ransomware?
CISA currently classifies the ransomware association as unknown, meaning there is no confirmed direct link to ransomware campaigns yet. However, the SYSTEM-level privilege escalation makes it a valuable tool for ransomware operators, and its KEV listing confirms active exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.