PT-2024-5720 · Microsoft · Windows+4

Alon Leviev · Published 2024-08-07 · Updated 2025-07-10 · CVE-2024-21302

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows versions prior to the April 2025 security updates Windows 10 versions prior to the April 2025 security updates Windows 11 versions prior to the April 2025 security updates Windows Server 2016 and higher versions prior to the April 2025 security updates Azure Virtual Machines (VM) that support Virtualization Based Security (VBS) prior to the April 2025 security updates

Description An elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security (VBS), including a subset of Azure Virtual Machine SKUS. This vulnerability enables an attacker with administrator privileges to replace current versions of Windows system files with outdated versions. By exploiting this vulnerability, an attacker could reintroduce previously mitigated vulnerabilities, circumvent some features of VBS, and exfiltrate data protected by VBS.

Recommendations To comprehensively address this issue, install the April 2025 security updates for all supported editions of Windows. For customers running affected versions of Windows, review KB5042562: Guidance for blocking rollback of virtualization-based security related updates to assess if the opt-in policy meets the needs of their environment before implementing this mitigation. Configure settings to monitor and log access attempts to critical system files. Review Identity Protection’s Risk Reports in Azure Active Directory.

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-06433

CVE-2024-21302

Affected Products

Azure Virtual Machine

Windows

Windows 10

Windows 11

Windows Server 2016

References · 78

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21302 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06433 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-21302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21302 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21302 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21302 · Vendor Advisory
• https://twitter.com/transilienceai/status/1853226146294345844 · Twitter Post
• https://t.me/msrcreports/2000 · Telegram Post
• https://t.me/cvedetector/2745 · Telegram Post
• https://twitter.com/Elshad1975/status/1824086300074656237 · Twitter Post
• https://t.me/true_secator/6144 · Telegram Post
• https://twitter.com/windowsforum/status/1856421929739227161 · Twitter Post
• https://t.me/echeloneyes/3327 · Telegram Post
• https://twitter.com/patchnow24x7/status/1823608237700342031 · Twitter Post
• https://t.me/cvenotify/90461 · Telegram Post