PT-2024-5585 · Microsoft · Windows

Luigino Camastra + 1 · Published 2024-08-13 · Updated 2025-10-19 · CVE-2024-38193

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the August 2024 update microsoft windows 10 1507 (<10.0.10240.20751) microsoft windows 10 1607 (<10.0.14393.7259) microsoft windows 10 1809 (<10.0.17763.6189) microsoft windows 10 21h2 (<10.0.19044.4780) microsoft windows 10 22h2 (<10.0.19045.4780)

Description The issue is related to a privilege escalation bug in the Windows Ancillary Function Driver (AFD.sys) for WinSock. It has been actively exploited by the Lazarus Group, a North Korea-linked APT group, to gain SYSTEM privileges on the latest Windows operating systems. The vulnerability allows attackers to manipulate kernel structures, gaining read and write access. It is a use-after-free flaw in the AFD.sys driver, which is installed by default on all Windows devices, making it a significant threat. The estimated number of potentially affected devices worldwide is not specified, but it is considered a major threat due to the widespread use of Windows devices.

Recommendations As a temporary workaround, consider disabling the afd.sys driver until a patch is available. Restrict access to the vulnerable module AFD.sys to minimize the risk of exploitation. Apply the August 2024 updates released by Microsoft to patch the vulnerability. Update Microsoft Windows to a version that includes the fix for this issue.

Exploit

Fix

LPE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2024-06270

CVE-2024-38193

Affected Products

Windows

References · 159

• 🔥 https://github.com/MzHmO/Exploit-Street/tree/main/2024/CVE-2024-38193 · Exploit
• 🔥 https://github.com/killvxk/CVE-2024-38193-Nephster · Exploit
• 🔥 https://github.com/Nephster/CVE-2024-38193 · Exploit
• 🔥 https://exploit-db.com/exploits/52284 · Exploit
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38193 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38193 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-38193 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06270 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38193 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38193 · Security Note
• https://twitter.com/ksg93rd/status/1887226143297970202 · Twitter Post
• https://twitter.com/rosterfe/status/1825568630928511055 · Twitter Post
• https://twitter.com/CERTologists/status/1825888374550315206 · Twitter Post
• https://twitter.com/ohhara_shiojiri/status/1827877058598625498 · Twitter Post
• https://twitter.com/pravin_karthik/status/1823545860963361035 · Twitter Post