Known Exploited Vulnerability
7.0
HIGH
CVE-2024-30088
Microsoft Windows Kernel TOCTOU Race Condition Vul - [Actively Exploited]
Description

Windows Kernel Elevation of Privilege Vulnerability

INFO

Published Date :

June 11, 2024, 5:15 p.m.

Last Modified :

Nov. 29, 2024, 3:44 p.m.

Source :

[email protected]

Remotely Exploitable :

No

Impact Score :

5.9

Exploitability Score :

1.0
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30088 ; https://nvd.nist.gov/vuln/detail/CVE-2024-30088

Public PoC/Exploit Available at Github

CVE-2024-30088 has a 18 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-30088 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Microsoft windows_server_2016
2 Microsoft windows_server_2019
3 Microsoft windows_10_1607
4 Microsoft windows_10_1809
5 Microsoft windows_10_21h2
6 Microsoft windows_10_22h2
7 Microsoft windows_server_2022
8 Microsoft windows_11_21h2
9 Microsoft windows_11_22h2
10 Microsoft windows_10_1507
11 Microsoft windows_11_23h2
12 Microsoft windows_server_2022_23h2
13 Microsoft windows_server_23h2
: Total Affected Vendor : 1 | Products : 13
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-30088.

URL Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088 Patch Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088 Patch Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
fazilbaig1/oscp

oscp notes

Updated: 4 days, 21 hours ago
0 stars 0 fork 0 watcher
Born at : Dec. 9, 2024, 6:26 p.m. This repo has been linked 66 different CVEs too.
Profile Photo
l0n3m4n/CVE-2024-30088

Windows Kernel Elevation of Privilege (PoC)

Updated: 2 months ago
0 stars 0 fork 0 watcher
Born at : Oct. 19, 2024, 1:54 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
Faizan-Khanx/OSCP

This repository is designed to provide a comprehensive collection of study materials, notes, and resources for the Offensive Security Certified Professional (OSCP) exam. It covers all key topics from basic to advanced, helping aspiring penetration testers to prepare efficiently for the exam.

cybersecurity hacking oscp oscp-guide oscp-journey oscp-prep

Updated: 1 month, 3 weeks ago
2 stars 0 fork 0 watcher
Born at : Oct. 4, 2024, 4:43 p.m. This repo has been linked 75 different CVEs too.
Profile Photo
EnriqueSanchezdelVillar/NotesHck

None

Python C Shell PHP PowerShell ASP.NET

Updated: 2 months ago
0 stars 0 fork 0 watcher
Born at : Oct. 1, 2024, 2:21 p.m. This repo has been linked 66 different CVEs too.
Profile Photo
Justintroup85/exploits-forsale-collateral-damage

Kernel exploit for Xbox SystemOS using CVE-2024-30088

Updated: 3 months, 3 weeks ago
1 stars 0 fork 0 watcher
Born at : Aug. 25, 2024, 12:47 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
Technetium1/stars

My stars. View raw for full list.

Updated: 3 weeks ago
1 stars 0 fork 0 watcher
Born at : Aug. 8, 2024, 6:44 p.m. This repo has been linked 9 different CVEs too.
Profile Photo
Admin9961/CVE-2024-30088

Questa repository contiene una replica (tentativo di replica) scritto in Python per CVE-2024-30088.

Python

Updated: 4 months ago
1 stars 0 fork 0 watcher
Born at : July 27, 2024, 10:41 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
Jappie3/starred

None

Updated: 2 weeks, 3 days ago
0 stars 0 fork 0 watcher
Born at : July 21, 2024, 11:33 a.m. This repo has been linked 3 different CVEs too.
Profile Photo
exploits-forsale/collateral-damage

Kernel exploit for Xbox SystemOS using CVE-2024-30088

C Assembly

Updated: 2 weeks, 3 days ago
426 stars 29 fork 29 watcher
Born at : July 15, 2024, 8:07 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
Zombie-Kaiser/CVE-2024-30088-Windows-poc

该漏洞存在于 NtQueryInformationToken 函数中，特别是在处理AuthzBasepCopyoutInternalSecurityAttributes 函数时，该漏洞源于内核在操作对象时对锁定机制的不当管理，这一失误可能导致恶意实体意外提升权限。

C C++

Updated: 3 weeks, 5 days ago
34 stars 14 fork 14 watcher
Born at : July 5, 2024, 4:02 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
NextGenPentesters/CVE-2024-30088-

🆘New Windows Kernel Priviledge Escalation Vulnerability

C C++

Updated: 1 month, 3 weeks ago
6 stars 1 fork 1 watcher
Born at : June 27, 2024, 7:05 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
tykawaii98/CVE-2024-30088

None

C C++

Updated: 2 weeks, 6 days ago
243 stars 54 fork 54 watcher
Born at : June 24, 2024, 10:37 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
youcannotseemeagain/ele

cobaltstrike的BypassUAC、提权dll插件

Updated: 3 weeks ago
72 stars 6 fork 6 watcher
Born at : Oct. 9, 2023, 3:52 a.m. This repo has been linked 7 different CVEs too.
Profile Photo
myseq/ms_patch_tuesday

Get quick summary of vulnerability stats and updates for Patch Tuesday.

security python3

Python

Updated: 4 months ago
0 stars 0 fork 0 watcher
Born at : April 13, 2022, 8:20 a.m. This repo has been linked 36 different CVEs too.
Profile Photo
GhostTroops/TOP

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things

bugbounty cve exp exploit payload poc rce vulnerability

Shell

Updated: 2 weeks, 3 days ago
675 stars 117 fork 117 watcher
Born at : March 19, 2022, 1:54 a.m. This repo has been linked 277 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-30088 vulnerability anywhere in the article.

  • Cybersecurity News
CVE-2024-21887 and More: How Earth Estries APT Group Exploits VPNs & Servers

Campaign Alpha overview | Image: Trend MicroIn a detailed report from Trend Micro, the Chinese advanced persistent threat (APT) group Earth Estries, also known by aliases like Salt Typhoon and GhostEm ... Read more

Published Date: Nov 27, 2024 (3 weeks, 5 days ago)
CVE-2024-52308 CVE-2024-10827 CVE-2024-10826 CVE-2024-30088 CVE-2023-48788 CVE-2023-22527 CVE-2024-21887 CVE-2023-46805
  • Cybersecurity News
Earth Estries’ Evolving Toolkit: A Deep Dive into Their Advanced Techniques

Trend Micro has uncovered details about a sophisticated cyberespionage campaign from Earth Estries, also known as Salt Typhoon. Active since 2020, Earth Estries primarily targets governments and techn ... Read more

Published Date: Nov 12, 2024 (1 month, 1 week ago)
CVE-2024-47460 CVE-2024-42509 CVE-2024-0126 CVE-2024-44133 CVE-2024-30088
  • The Hacker News
THN Cybersecurity Recap: Top Threats, Tools and News (Oct 14 - Oct 20)

Cybersecurity / Weekly Recap Hi there! Here's your quick update on the latest in cybersecurity. Hackers are using new tricks to break into systems we thought were secure—like finding hidden doors in l ... Read more

Published Date: Oct 21, 2024 (2 months ago)
CVE-2024-9486 CVE-2024-9164 CVE-2024-9487 CVE-2024-8963 CVE-2024-44133 CVE-2024-40711 CVE-2024-28987 CVE-2024-38178 CVE-2024-30088 CVE-2024-23113
  • SentinelOne
The Good, the Bad and the Ugly in Cybersecurity – Week 42

The Good | DoJ Unseals Indictment Against Notorious ‘Anonymous Sudan’ DDoS Operators An unsealed indictment charged two brothers with operating the hacktivist group ‘Anonymous Sudan’, responsible for ... Read more

Published Date: Oct 18, 2024 (2 months ago)
CVE-2024-30088
  • SentinelOne
The Good, the Bad and the Ugly in Cybersecurity – Week 42

The Good | DoJ Unseals Indictment Against Notorious ‘Anonymous Sudan’ DDoS Operators An unsealed indictment charged two brothers with operating the hacktivist group ‘Anonymous Sudan’, responsible for ... Read more

Published Date: Oct 18, 2024 (2 months ago)
CVE-2024-30088
  • Dark Reading
Iran's APT34 Abuses MS Exchange to Spy on Gulf Gov'ts

Source: Daniren via Alamy Stock PhotoAn Iranian threat actor has been ramping up its espionage against Gulf-state government entities, particularly those within the United Arab Emirates (UAE).APT34 (a ... Read more

Published Date: Oct 17, 2024 (2 months ago)
CVE-2024-30088
  • The Cyber Express
SolarWinds, Firefox, Windows Face Active Exploitation: CISA Issues Urgent Warning

The Cybersecurity and Infrastructure Security Agency (CISA) has recently added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, emphasizing the pressing need for organizatio ... Read more

Published Date: Oct 17, 2024 (2 months ago)
CVE-2024-9680 CVE-2024-40711 CVE-2024-28987 CVE-2024-30088 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805 CVE-2021-44228 CVE-2017-11882
  • BleepingComputer
SolarWinds Web Help Desk flaw is now exploited in attacks

CISA has added three flaws to its 'Known Exploited Vulnerabilities' (KEV) catalog, among which is a critical hardcoded credentials flaw in SolarWinds Web Help Desk (WHD) that the vendor fixed in late ... Read more

Published Date: Oct 16, 2024 (2 months ago)
CVE-2024-9680 CVE-2024-28987 CVE-2024-30088
  • TheCyberThrone
CISA KEV Catalog Update Part IV – October 2024

The US CISA has added below vulnerabilities to its Known Exploited Vulnerabilities Catalog based on the evidence of active exploitation.CVE-2024-30088 Microsoft Windows Kernel contains a time-of-check ... Read more

Published Date: Oct 16, 2024 (2 months, 1 week ago)
CVE-2024-46911 CVE-2024-9164 CVE-2024-9487 CVE-2024-9680 CVE-2024-28987 CVE-2024-30088
  • Cybersecurity News
Earth Simnavaz Exploits Windows Kernel Flaw CVE-2024-30088 in Attacks on Critical Infrastructure

Attack chain | Image: Trend MicroTrend Micro researchers have uncovered a series of advanced cyberattacks carried out by the threat group Earth Simnavaz, also known as APT34 or OilRig. This Iranian-li ... Read more

Published Date: Oct 15, 2024 (2 months, 1 week ago)
CVE-2024-43047 CVE-2024-33066 CVE-2024-9194 CVE-2024-30088
  • BleepingComputer
Iranian hackers now exploit Windows flaw to elevate privileges

The Iranian state-sponsored hacking group APT34, aka OilRig, has recently escalated its activities with new campaigns targeting government and critical infrastructure entities in the United Arab Emira ... Read more

Published Date: Oct 13, 2024 (2 months, 1 week ago)
CVE-2024-30088
  • The Hacker News
OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf

The Iranian threat actor known as OilRig has been observed exploiting a now-patched privilege escalation flaw impacting the Windows Kernel as part of a cyber espionage campaign targeting the U.A.E. an ... Read more

Published Date: Oct 13, 2024 (2 months, 1 week ago)
CVE-2024-30088
  • Trend Micro
Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East

APT & Targeted Attacks Trend Micro's investigation into the recent activity of Earth Simnavaz provides new insights into the APT group’s evolving tactics and the immediate threat it poses to sectors i ... Read more

Published Date: Oct 11, 2024 (2 months, 1 week ago)
CVE-2024-30088

The following table lists the changes that have been made to the CVE-2024-30088 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Modified Analysis by [email protected]

    Nov. 29, 2024

    Action Type Old Value New Value
    Changed CPE Configuration OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.10240.20680 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7070 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.5936 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.4529 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19045.4529 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.3019 *cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22621.3737 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22631.3737 *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7070 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.5936 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.2522 *cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.25398.950 OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.10240.20680 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* versions up to (excluding) 10.0.14393.7070 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* versions up to (excluding) 10.0.14393.7070 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.5936 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.4529 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19045.4529 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.3019 *cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22621.3737 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22631.3737 *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7070 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.5936 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.2522 *cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.25398.950
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Oct. 16, 2024

    Action Type Old Value New Value
    Added Due Date 2024-11-05
    Added Date Added 2024-10-15
    Added Vulnerability Name Microsoft Windows Kernel TOCTOU Race Condition Vulnerability
    Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  • Initial Analysis by [email protected]

    Jun. 21, 2024

    Action Type Old Value New Value
    Changed Reference Type https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088 No Types Assigned https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088 Patch, Vendor Advisory
    Added CWE NIST CWE-367
    Added CPE Configuration OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.10240.20680 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7070 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.5936 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.4529 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19045.4529 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.3019 *cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22621.3737 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22631.3737 *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7070 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.5936 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.2522 *cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.25398.950
  • CVE Modified by [email protected]

    Jun. 20, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Jun. 17, 2024

    Action Type Old Value New Value
  • CVE Received by [email protected]

    Jun. 11, 2024

    Action Type Old Value New Value
    Added Description Windows Kernel Elevation of Privilege Vulnerability
    Added Reference Microsoft Corporation https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088 [No types assigned]
    Added CWE Microsoft Corporation CWE-367
    Added CVSS V3.1 Microsoft Corporation AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-30088 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-30088 weaknesses.

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: