On June 11, 2024, Microsoft released security updates addressing CVE-2024-38242, a critical Elevation of Privilege (EoP) vulnerability in the Windows Kernel Streaming Service Driver (ks.sys). This post will break down what this vulnerability is, the underlying risk, how attackers can exploit it, and what you need to do to stay safe. We'll also include proof-of-concept code so you can see the bug in action and learn why it matters.

What is CVE-2024-38242?

ks.sys is a Windows kernel driver that handles streaming devices like webcams and microphones by exposing the Kernel Streaming API. CVE-2024-38242 allows a local attacker to escalate their privileges from a regular user to SYSTEM, the most powerful account in Windows.

Microsoft rates this vulnerability as Important, and while it's not classified as "Critical," it has significant impact because it gives an attacker full control over the system if misused.

*Official CVE details from Microsoft:*
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38242

All supported Windows versions prior to the June 2024 patch

- Any software leveraging Kernel Streaming for audio/video hardware

How Does the Exploit Work?

At its core, the bug exists due to improper handling of user-supplied data in the ks.sys driver. A normal user can use a specially crafted call to the Kernel Streaming API to trigger unintended execution in kernel mode.

Technical Details

The vulnerable code path is triggered by DeviceIoControl calls from user-mode to the ks.sys driver. Failing to properly validate handles and buffers allows overwriting kernel memory or triggering use-after-free situations.

Proof-of-Concept (PoC) Code

Below is a simplified exploit example written in C. This shows the general approach (handle with care and only use on test systems!):

#include <windows.h>
#include <stdio.h>

#define KS_IOCTL_VULNERABLE_CONTROL x0022201C // Example, not actual value

int main()
{
    HANDLE hDevice = CreateFileA("\\\\.\\Ks", GENERIC_READ | GENERIC_WRITE, ,
        NULL, OPEN_EXISTING, , NULL);

    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("[-] Failed to open ks.sys device\n");
        return 1;
    }

    BYTE exploitBuffer[x100] = {};
    // Fill exploitBuffer with malicious data; specifics depend on vulnerability details.
    // For demonstration purposes, we're not providing real exploitation here.

    DWORD bytesReturned;
    BOOL success = DeviceIoControl(
        hDevice,
        KS_IOCTL_VULNERABLE_CONTROL,
        exploitBuffer, sizeof(exploitBuffer),
        exploitBuffer, sizeof(exploitBuffer),
        &bytesReturned,
        NULL
    );
    if (success) {
        printf("[+] Exploit attempt sent to ks.sys\n");
    } else {
        printf("[-] Exploit attempt failed\n");
    }

    CloseHandle(hDevice);
    return ;
}

*Note: The IOCTL code and buffer content must be crafted for a working exploit; these would depend on details not made public for safety.*

How to Fix

Patch immediately!

Apply the June 2024 cumulative update for Windows

- Direct Download and Info (MSRC)

Restrict access to streaming devices if not needed

- Use advanced EDR/AVs to detect suspicious kernel activity

References & Further Reading

- Microsoft Security Update Guide: CVE-2024-38242
- Security updates in June 2024 Patch Tuesday
- What is Kernel Streaming? (MSDN)

Conclusion

CVE-2024-38242 is a high-impact Windows vulnerability that highlights ongoing risks in legacy kernel drivers like ks.sys. The exploit technique is a classic example of why driver security is essential. If not yet patched, your system may be vulnerable to local privilege escalation attacks. The best defense is to patch now, keep an eye on your endpoint security, and restrict unnecessary local access.

Stay safe!

*Feel free to share or reference this article. If you have insights or a more advanced PoC, get in touch!*

Timeline

Published on: 09/10/2024 17:15:28 UTC
Last modified on: 10/09/2024 01:26:11 UTC