CVE-2024-38184 - Inside the Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

On June 2024, Microsoft patched a new and serious vulnerability tracked as CVE-2024-38184 in the Windows operating system. This vulnerability affects Windows Kernel-Mode Drivers, an essential piece of the Windows OS that runs with the highest system privileges. If exploited, this vulnerability allows attackers to elevate their privileges on a compromised system—potentially leading to full system takeover. Let's dive in, look at some code snippets, and understand how this vulnerability works.

What Is CVE-2024-38184?

CVE-2024-38184 is classified as an Elevation of Privilege (EoP) vulnerability in the Windows kernel-mode driver (ntoskrnl.exe and related drivers). The flaw enables local attackers (already on the system) to gain SYSTEM-level access, which is the highest level of privileges in Windows.

Official References

- Microsoft Security Update Guide: CVE-2024-38184
- NVD CVE Page

How Does the Vulnerability Work?

The vulnerability is caused by improper handling of input validation in one of the privileged kernel-mode drivers. An attacker can craft a malicious input or perform a specific set of actions in userland, which the kernel does not properly validate, exposing the system to privilege escalation.

Code Snippet: Proof-of-Concept (PoC)

*(Disclaimer: For educational purposes only. Do not use on systems you do not own. Full exploit code is not published due to ethical reasons, but here's an illustrative snippet.)*

Let's suppose the vulnerable IOCTL code is x222003 for a hypothetical driver VulnDrv.sys. Attackers can use device IOCTL (input/output control) requests to trigger the bug.

#include <windows.h>
#include <stdio.h>

#define IOCTL_VULN_EOP CTL_CODE(FILE_DEVICE_UNKNOWN, x801, METHOD_BUFFERED, FILE_ANY_ACCESS)

int main() {
    HANDLE hDevice = CreateFileA("\\\\.\\VulnDrv", 
                                GENERIC_READ | GENERIC_WRITE, , NULL, 
                                OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[-] Could not open device: %d\n", GetLastError());
        return 1;
    }

    char inBuffer[256] = {};
    // Fill inBuffer in a way that triggers the bug
    memset(inBuffer, 'A', sizeof(inBuffer)); // Illustrative

    DWORD bytesReturned;
    BOOL result = DeviceIoControl(hDevice, IOCTL_VULN_EOP, 
                                 inBuffer, sizeof(inBuffer),
                                 NULL, , &bytesReturned, NULL);

    if (result) {
        printf("[+] Exploit sent! Check privileges.\n");
    } else {
        printf("[-] DeviceIoControl failed: %d\n", GetLastError());
    }

    CloseHandle(hDevice);
    return ;
}

*Note: The actual exploit requires knowledge of the exact driver interface and the vulnerability details.*

Patching is critical. Microsoft released a hotfix which can be found here

- Microsoft Security Update for June 2024

Technical Deep Dive: What Went Wrong?

The vulnerability likely involves incorrect handling of privileged actions in the Windows Kernel-Mode Driver:

Potential for buffer overflows, race conditions, or privilege permission issues

Security researchers discovered that, by exploiting this weakness, an unprivileged user can craft a custom request that is interpreted by the kernel as coming from SYSTEM.

Summary

To wrap up, CVE-2024-38184 is a serious bug in Windows kernel-mode drivers. If left unpatched, it allows local users to become SYSTEM, potentially breaking all built-in Windows security. Patch your systems, restrict unnecessary access, and stay alert for suspicious activity on endpoints.

Timeline

Published on: 08/13/2024 18:15:26 UTC
Last modified on: 10/16/2024 01:53:15 UTC