PT-2024-7862 · Microsoft · Windows 11+3

Immortalp0Ny + 1 · Published 2024-07-10 · Updated 2024-12-20 · CVE-2024-43629

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows DWM Core Library versions prior to the fixed version

Description The issue is related to an elevation of privilege vulnerability in the Windows DWM Core Library, which can be exploited to allow an attacker to gain system-level privileges. This vulnerability is associated with the indirect bypass of the process check about DWM of NtDCompositionDuplicateHandleToProcess, leading to a kernel arbitrary address write. The vulnerability affects all current versions of Windows, including Windows 10, 11, and server editions. Microsoft has released security updates to patch this vulnerability.

Recommendations For Windows DWM Core Library versions prior to the fixed version, apply the security update released by Microsoft to patch the vulnerability. As a temporary workaround, consider restricting access to the DWM Core Library until the patch is applied. Avoid using the NtDCompositionDuplicateHandleToProcess function in the affected library until the issue is resolved.

Fix

LPE

Untrusted Pointer Dereference

Weakness Enumeration

CWE-457

CWE-822

Related Identifiers

BDU:2024-09364

CVE-2024-43629

Affected Products

Windows

Windows 10

Windows 11

Windows Dwm Core Library

References · 20

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43629 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43629 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43629 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43629 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09364 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-43629 · Security Note
• https://twitter.com/UndercodeNews/status/1858668330229350505 · Twitter Post
• https://t.me/true_secator/6438 · Telegram Post
• https://t.me/avleonovcom/1469 · Telegram Post
• https://twitter.com/TinySecEx/status/1856594371224973331 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1857319143307149488 · Twitter Post
• https://twitter.com/PTsecurity_EN/status/1856703659993620539 · Twitter Post
• https://twitter.com/immortalp0ny/status/1859149914900492372 · Twitter Post
• https://t.me/cvenotify/102068 · Telegram Post
• https://twitter.com/UndercodeNews/status/1858664290959659336 · Twitter Post