PT-2024-5637 · Microsoft · Windows
Published
2024-08-13
·
Updated
2024-11-20
·
CVE-2024-38106
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows (affected versions not specified)
Description
The issue is related to an elevation of privilege vulnerability in the Windows kernel. This vulnerability allows attackers to elevate their privileges, potentially leading to system compromise. The vulnerability is due to a race condition in the
NtQueryInformationJobObject and NtSetInformationJobObject functions. It has been actively exploited by a North Korean threat actor known as Citrine Sleet. A proof-of-concept exploit has been publicly released, demonstrating the vulnerability's potential for exploitation. The vulnerability affects the ntoskrnl.exe process and can be used to gain system-level access without user consent.Recommendations
To resolve the issue, apply the Microsoft patch for the vulnerability, which was released in the August 2024 Patch Tuesday updates. Ensure all Windows systems are updated to include the latest security patches. As a temporary workaround, consider restricting access to the
ntoskrnl.exe process to minimize the risk of exploitation. However, the most effective resolution is to apply the patch. At the moment, there is no information about alternative fixes or workarounds that can fully mitigate the vulnerability without applying the official patch.Fix
LPE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Windows