PT-2024-1704 · Microsoft · Appid.Sys+8

Jan Vojtěšek · Published 2024-02-13 · Updated 2026-05-03 · CVE-2024-21338

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the February 2024 Patch Tuesday update Windows 10 version 10.0.17763.5458 and earlier Windows 11 and Windows Server 2022 and Windows Server 2019 (affected versions not specified)

Description The issue is related to an elevation of privilege vulnerability in the Windows Kernel, caused by insufficient access control in IOCTL commands. This allows attackers to escalate privileges. The vulnerability was exploited by the Lazarus Group as a zero-day, enabling the bypass of security measures like Windows Defender. The flaw was found in the appid.sys Windows AppLocker driver.

Recommendations Apply the February 2024 Patch Tuesday updates to fix the vulnerability in Microsoft Windows AppLocker. Update Windows 10 to version 10.0.17763.5459 or later. Update Windows 11 and Windows Server 2022 and Windows Server 2019 to the latest version. As a temporary workaround, consider disabling the appid.sys driver until a patch is available. Restrict access to the appid.sys driver to minimize the risk of exploitation.

Exploit

Fix

LPE

Untrusted Pointer Dereference

Improper Privilege Management

Weakness Enumeration

CWE-822

CWE-264

CWE-269

Related Identifiers

BDU:2024-01398

CVE-2024-21338

Affected Products

Windows

Windows 10

Windows 11

Windows Applocker

Windows Defender

Windows Kernel

Windows Server 2019

Windows Server 2022

Appid.Sys

References · 183

• 🔥 https://github.com/hakaioffsec/CVE-2024-21338 · Exploit
• 🔥 https://github.com/Crowdfense/CVE-2024-21338 · Exploit
• 🔥 https://github.com/tykawaii98/CVE-2024-21338_PoC · Exploit
• 🔥 https://github.com/varwara/CVE-2024-21338 · Exploit
• 🔥 https://github.com/Zombie-Kaiser/CVE-2024-21338-x64-build- · Exploit
• 🔥 https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day · Exploit
• 🔥 https://exploit-db.com/exploits/51946 · Exploit
• 🔥 https://exploit-db.com/exploits/52275 · Exploit
• 🔥 https://packetstorm.news/files/id/190586 · Exploit
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-21338 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21338 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21338 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01398 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-21338 · Security Note