PT-2024-6178 · Microsoft · Windows Kernel-Mode Driver+1

Philippe Laulheret · Published 2024-08-13 · Updated 2024-12-17 · CVE-2024-38185

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Kernel-Mode Driver versions prior to 10.0.22000.3079

Description The issue is related to an elevation-of-privilege vulnerability in the Windows Kernel-Mode Driver, which can be exploited due to the dereferencing of an untrusted pointer. This vulnerability allows an attacker to elevate their privileges.

Recommendations For versions prior to 10.0.22000.3079, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Untrusted Pointer Dereference

Time Of Check To Time Of Use

Weakness Enumeration

CWE-822

CWE-367

Related Identifiers

BDU:2024-07099

BDU:2024-07100

CVE-2024-38185

Affected Products

Windows

Windows Kernel-Mode Driver

References · 17

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38185 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07100 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38185 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38185 · Security Note
• https://bdu.fstec.ru/vul/2024-07099 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38185 · Vendor Advisory
• https://twitter.com/rst_cloud/status/1824716406224568600 · Twitter Post
• https://twitter.com/windowsforum/status/1831817360937796044 · Twitter Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2024-1965 · Note
• https://github.com/advisories/GHSA-59m8-4xq6-9rfh · Note
• https://blog.talosintelligence.com/finding-vulnerabilities-in-clipsp-the-driver-at-the-core-of-windows-client-license-platform · Reddit Post
• https://vulners.com/nvd/NVD:CVE-2024-38186 · Note
• https://t.me/aptreports/11983 · Telegram Post
• https://t.me/cvenotify/90988 · Telegram Post