CVE-2024-38193
Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability
Description
CVE-2024-38193 is a high-severity elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys), carrying a CVSS v3.1 base score of 7.8. The vulnerability allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access by exploiting a flaw in the kernel-mode AFD driver. CISA has added CVE-2024-38193 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 3, 2024, and its ransomware association is classified as unknown. With an exceptionally high EPSS score of 74.83% at the 98.8th percentile, this is one of the most actively exploited Windows vulnerabilities, with a public exploit available on Exploit-DB. The vulnerability affects an extensive range of Windows versions from Server 2008 through Windows 11 24H2.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.20751 |
| microsoft | windows 10 1607 | < 10.0.14393.7259 |
| microsoft | windows 10 1809 | < 10.0.17763.6189 |
| microsoft | windows 10 21h2 | < 10.0.19044.4780 |
| microsoft | windows 10 22h2 | < 10.0.19045.4780 |
| microsoft | windows 11 21h2 | < 10.0.22000.3147 |
| microsoft | windows 11 22h2 | < 10.0.22621.4037 |
| microsoft | windows 11 23h2 | < 10.0.22631.4037 |
| microsoft | windows 11 24h2 | < 10.0.26100.1457 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | < 6.2.9200.25031; r2 |
| microsoft | windows server 2016 | < 10.0.14393.7259 |
| microsoft | windows server 2019 | < 10.0.17763.6189 |
| microsoft | windows server 2022 | < 10.0.20348.2655 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1085 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38193(Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/52284(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38193(US Government Resource)
Weakness Type
Elevation of Privilege in Windows AFD.sys Driver
CVE-2024-38193 targets the Windows Ancillary Function Driver for WinSock (AFD.sys), a critical kernel-mode driver that provides the core networking functionality underlying the Windows Sockets (Winsock) API. AFD.sys acts as an intermediary between user-mode networking applications and the underlying transport protocol drivers (TCP/IP). Because AFD.sys runs in kernel mode with full system privileges, any vulnerability that allows an attacker to corrupt its state or hijack its execution flow directly translates to SYSTEM-level code execution. The vulnerability involves improper handling of memory operations within the driver, enabling a use-after-free or boundary violation condition that an attacker can leverage to execute arbitrary code at the kernel privilege level.
Impact Analysis
The business impact of CVE-2024-38193 is severe across all dimensions, with maximum ratings for confidentiality, integrity, and availability. Confidentiality is fully compromised because SYSTEM-level access via a kernel driver grants unrestricted read access to all data on the affected system, including operating system credentials, Active Directory cached credentials, application secrets, encryption keys, and any files regardless of their access control lists.
Integrity faces maximum impact as the attacker gains the ability to modify any system component. Kernel-level access through AFD.sys enables installation of rootkits that can hide malicious activity from security tools, modification of system binaries, tampering with security event logs, and creation of persistent backdoors that survive standard remediation attempts.
Availability is completely at risk since SYSTEM-level control allows the attacker to disable services, corrupt the operating system, deploy ransomware, or cause system crashes. The exceptionally high EPSS score of 74.83% at the 98.8th percentile, combined with the availability of a public exploit, makes this one of the most dangerous privilege escalation vulnerabilities in the current threat landscape. The broad range of affected systems, spanning from Windows Server 2008 to Windows 11 24H2, means virtually every Windows deployment is potentially at risk.
Exploit Maturity
CVE-2024-38193 has reached an extremely high level of exploit maturity with confirmed active exploitation, public exploit code, and an EPSS score among the highest observed. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of September 3, 2024. The EPSS score of 74.83% at the 98.8th percentile places it in the top tier of actively exploited vulnerabilities globally.
A fully functional public exploit is available on Exploit-DB (EDB-52284), providing detailed exploitation code that targets the AFD.sys driver vulnerability. The availability of weaponized exploit code significantly lowers the barrier to entry for attackers, enabling less sophisticated threat actors to incorporate this vulnerability into their toolkits. Microsoft has confirmed exploitation in the wild through its security advisory. The ransomware association is currently classified as unknown by CISA, but the combination of reliable SYSTEM-level escalation, public exploit availability, and massive exploitation volumes makes it a prime candidate for inclusion in ransomware delivery chains.
Remediation
-
Apply the August 2024 Microsoft security updates as an emergency priority. Install the cumulative update from the Microsoft Security Response Center advisory. Given the public exploit availability and near-maximum EPSS score, this patch should be treated as the highest priority. Ensure all Windows versions are updated, including legacy systems running Windows Server 2008 and Server 2012.
-
Prioritize systems with network exposure and sensitive workloads. While the vulnerability requires local access (AV:L), any system reachable by users or connected to the network is at risk once an attacker gains initial access. Focus on domain controllers, file servers, database servers, and workstations with privileged access.
-
Implement exploit mitigation controls. Enable Windows Defender Credential Guard to protect cached credentials. Deploy Exploit Protection policies through Microsoft Defender to detect and block kernel exploitation techniques. Enable Hardware-based Security features such as Hypervisor-protected Code Integrity (HVCI) where hardware supports it.
-
Monitor for public exploit usage. Since a public exploit is available on Exploit-DB, security operations teams should update their detection signatures and behavioral analytics to identify AFD.sys exploitation attempts. Monitor for unusual kernel-mode activity, unexpected driver loads, and SYSTEM-level process creation from low-privilege user contexts.
-
Address legacy Windows Server 2008 systems. The inclusion of Windows Server 2008 in the affected products list means organizations still running these end-of-life systems face particular risk. Plan immediate migration or isolation of these systems, as they may require Extended Security Updates (ESU) to receive the patch.
Technical Details
CVE-2024-38193 carries a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, producing a high base score of 7.8. The attack vector is local (AV:L), requiring authenticated access to the target system. The attack complexity is low (AC:L), meaning exploitation is reliable and does not depend on race conditions or special configurations. Low privileges (PR:L) are sufficient, and no user interaction (UI:N) is required.
The vulnerability exists in AFD.sys (Ancillary Function Driver for WinSock), the kernel-mode driver that implements the core Winsock functionality. AFD.sys processes I/O request packets (IRPs) from user-mode applications that use the Winsock API for network communications. The vulnerability involves improper validation or management of memory objects within the driver's IRP handling path. By sending specially crafted Winsock operations through user-mode API calls, an attacker can trigger a condition where the driver accesses memory that has already been freed or operates on a buffer beyond its intended boundaries. This memory corruption primitive can then be leveraged to overwrite kernel data structures, such as process token pointers or function pointers in dispatch tables, to escalate the calling process to SYSTEM privileges. The scope is unchanged (S:U), but gaining SYSTEM access through a network driver provides an attacker with a powerful foothold for lateral movement and further compromise. The affected product range is exceptionally broad, spanning from Windows Server 2008 through the latest Windows 11 24H2 and Windows Server 2022 23H2.
Frequently Asked Questions
What is CVE-2024-38193?
CVE-2024-38193 is a high-severity elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys) that enables a local attacker with low privileges to gain SYSTEM-level access. It has a CVSS v3.1 score of 7.8 and a public exploit is available.
Why is CVE-2024-38193 considered especially dangerous?
This vulnerability combines several risk factors that make it exceptionally dangerous: a publicly available exploit on Exploit-DB, an EPSS score of 74.83% at the 98.8th percentile indicating massive exploitation volumes, confirmed active exploitation in the wild, and an affected product range spanning nearly every Windows version from Server 2008 to Windows 11 24H2.
Is there a public exploit for CVE-2024-38193?
Yes, a fully functional exploit is publicly available on Exploit-DB (EDB-52284). This significantly lowers the barrier for attackers and increases the urgency of applying the Microsoft security update.
Does CVE-2024-38193 affect Windows Server 2008?
Yes, Windows Server 2008 and Server 2008 R2 are included in the list of affected products. Organizations still running these end-of-life systems should apply Extended Security Updates or prioritize migration to supported Windows versions.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.