PT-2024-4172 · Microsoft · Exchange Server+1

Carrot_C4K3 · Published 2024-06-11 · Updated 2026-06-15 · CVE-2024-30088

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows 10 versions 1809 through 22H2 Windows 11 versions 21H2 through 23H2 Windows Server 2019 Windows Server 2022 Windows Server 2025 Server Core installations prior to February 2025 updates

Description A local privilege escalation issue exists in the Windows Kernel due to a race condition and improper synchronization in the Object Manager. The flaw is specifically linked to an error in the implementation of the NtQueryInformationToken() function and an unchecked integer multiplication that leads to an integer overflow. This causes the kernel to allocate a buffer smaller than required, resulting in an out-of-bounds write that allows attackers to corrupt kernel memory and replace process tokens with the SYSTEM token. This can lead to a full bypass of User Account Control (UAC) and security boundaries, enabling the installation of rootkits, bootkits, and credential theft from LSA memory. The issue has been actively exploited by the Iranian threat actor OilRig (APT34) in cyber espionage campaigns targeting infrastructure in the UAE and the Gulf region.

Recommendations Update all affected systems to Security Update KB5034763 or later cumulative updates. Enable Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) where supported to harden endpoints.

Exploit

Fix

LPE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2024-04657

CVE-2024-30088

ZDI-24-606

Affected Products

Exchange Server

Windows

References · 112

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2024_30088_authz_basep.rb · Exploit
• 🔥 https://github.com/exploits-forsale/collateral-damage · Exploit
• 🔥 https://github.com/tykawaii98/CVE-2024-30088 · Exploit
• 🔥 https://github.com/Zombie-Kaiser/CVE-2024-30088-Windows-poc · Exploit
• 🔥 https://github.com/NextGenPentesters/CVE-2024-30088- · Exploit
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30088 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-606 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-30088 · Security Note
• https://bdu.fstec.ru/vul/2024-04657 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-30088 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30088 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30088 · Vendor Advisory
• https://github.com/aaaddress1/RunPE-In-Memory · Note
• https://twitter.com/Loginsoft_Inc/status/1846052070735937888 · Twitter Post