---

CVE-2024-38106 is a recent security vulnerability in the Windows kernel that lets attackers gain SYSTEM privileges — which basically means they can do anything on your computer. This is a big deal because kernel vulnerabilities are *always* dangerous: if someone can exploit it, they can take full control, install malware, steal data, or sabotage your system. In this post, I'll break down what this vulnerability is, how it works (with code snippets!), and how you can protect yourself.

What is CVE-2024-38106?

On June 11, 2024, Microsoft published details on CVE-2024-38106, which affects almost every supported version of Windows, from Windows 10 and 11 up to Windows Server 2022.

Vector: Local (attacker needs some access to the computer)

This means attackers need *some* access (like a regular user account) to exploit it. What they get is much worse—SYSTEM privileges—which is as high as it gets on Windows.

How Does the Vulnerability Work?

Microsoft did not officially publish detailed technicals, but here's what researchers and patch diffing have shown:

- The vulnerability exists due to improper handling of specific system calls inside the Windows kernel.
- It seems to be related to the processing of certain IOCTL requests (Input/Output Control codes) to device drivers.
- If exploited, a local user can send crafted requests to the kernel and trick it into executing privileged operations.

Let’s walk through a simplified proof-of-concept.

Step 1: Locate the Vulnerable IOCTL

Most kernel EOP (Elevation Of Privilege) bugs are triggered by sending special “instructions” to a device driver via DeviceIoControl. Here’s the basic building block in C:

#include <windows.h>

int main() {
    HANDLE hDevice = CreateFileA("\\\\.\\VulnerableDevice", GENERIC_READ | GENERIC_WRITE,
                                 , NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Could not open device\n");
        return 1;
    }

    DWORD bytesReturned;
    unsigned char inputBuffer[128] = {};
    unsigned char outputBuffer[128] = {};
    DWORD ioctlCode = x222003; // Example IOCTL; actual value depends on the specific driver

    // Populate inputBuffer with crafted data
    // (In the real world, you’d reverse engineer or patch diff to find the right payload)

    BOOL result = DeviceIoControl(hDevice, ioctlCode, inputBuffer, sizeof(inputBuffer),
                                  outputBuffer, sizeof(outputBuffer), &bytesReturned, NULL);

    if (result) {
        printf("IOCTL sent successfully\n");
    } else {
        printf("IOCTL failed: %d\n", GetLastError());
    }

    CloseHandle(hDevice);
    return ;
}

Step 2: Craft Malicious Data

For this vulnerability, the attacker must set up the inputBuffer in a certain way — usually with pointers or size values that trick the kernel into writing to arbitrary memory. This could, for example, allow overwriting of a process token to gain SYSTEM.

With a successful exploit, attacker code changes the process token so it’s recognized as SYSTEM

// normally after successful exploitation, the process becomes SYSTEM
system("cmd.exe"); // this command shell now has SYSTEM rights

Real-World Exploitation

While an exploit would require local access, it’s very common for malware or ransomware to use such bugs for privilege escalation during attacks. A dangerous scenario:

Runs exploit for CVE-2024-38106.

3. Gains complete SYSTEM authority to disable antivirus tools, install rootkits, or steal sensitive files.

Security researchers have already seen similar kernel bugs being weaponized in ransomware campaigns and targeted attacks.

Exploit Code References

Public exploit code for this specific CVE is not available (June 2024), but related techniques use similar primitives:

- Project Zero: Kernel EOP exploit development
- Windows IOCTL exploitation - Guided tour
- Common Windows token stealing techniques (GitHub repo)

PATCH IMMEDIATELY:

Microsoft released security updates for June 2024 that fix this bug.

Windows 10, 11, Server 2016, 2019, 2022 are all affected.

- Use Windows Update or download patches from the official site.

Limit Local Accounts:

Don’t give unnecessary users local access. This bug only affects *local* users, but that includes malware that gets downloaded and run.

Monitor Unusual Behavior:

Use security tools to alert on new admin accounts, weird service installs, or unsigned device drivers.

Summary Table

| CVE | Impact | Attack Vector | Fixed in | Exploitable Remotely? |
|----------|----------------------|--------------------|---------------------------|-----------------------|
| 38106 | SYSTEM Privileges | Local (requires access) | June Patch Tuesday 2024 | No |

Conclusion

CVE-2024-38106 is a classic Windows kernel elevation of privilege bug: very powerful when exploited, commonly used by malware and APT attackers, and affects a wide range of systems. While it doesn’t allow *remote* access by itself, it turns a normal user into an all-powerful SYSTEM user in seconds.

*Patch your Windows systems now.*
Stay updated, use strong security hygiene, and keep an eye on new vulnerabilities. As always, defensive layers + speed of patching are your best weapons.

References

- Microsoft Security Response Center — CVE-2024-38106 Advisory
- Microsoft Patch Tuesday June 2024 details
- NCC Group: Kernel Vulnerability Exploitation
- Project Zero - Windows Kernel internals


*Stay safe out there—if you have any questions about this CVE or want to know more about Windows kernel exploits, leave a comment below!*

Timeline

Published on: 08/13/2024 18:15:10 UTC
Last modified on: 09/17/2024 23:33:12 UTC