CVE-2024-30088
Microsoft Windows Kernel TOCTOU Race Condition Vul - [Actively Exploited]
Description
Windows Kernel Elevation of Privilege Vulnerability
INFO
Published Date :
June 11, 2024, 5:15 p.m.
Last Modified :
Oct. 16, 2024, 1 a.m.
Source :
[email protected]
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.0
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30088 ; https://nvd.nist.gov/vuln/detail/CVE-2024-30088
Public PoC/Exploit Available at Github
CVE-2024-30088 has a 15 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
Affected Products
The following products are affected by CVE-2024-30088
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-30088.
| URL | Resource |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088 | Patch Vendor Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Windows Kernel Elevation of Privilege (PoC)
This repository is designed to provide a comprehensive collection of study materials, notes, and resources for the Offensive Security Certified Professional (OSCP) exam. It covers all key topics from basic to advanced, helping aspiring penetration testers to prepare efficiently for the exam.
cybersecurity hacking oscp oscp-guide oscp-journey oscp-prep
None
Python C Shell PHP PowerShell ASP.NET
Kernel exploit for Xbox SystemOS using CVE-2024-30088
Questa repository contiene una replica (tentativo di replica) scritto in Python per CVE-2024-30088.
Python
None
Kernel exploit for Xbox SystemOS using CVE-2024-30088
C Assembly
该漏洞存在于 NtQueryInformationToken 函数中，特别是在处理AuthzBasepCopyoutInternalSecurityAttributes 函数时，该漏洞源于内核在操作对象时对锁定机制的不当管理，这一失误可能导致恶意实体意外提升权限。
C C++
🆘New Windows Kernel Priviledge Escalation Vulnerability
C C++
None
C C++
cobaltstrike的BypassUAC、提权dll插件
Get quick summary of vulnerability stats and updates for Patch Tuesday.
security python3
Python
TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things
bugbounty cve exp exploit payload poc rce vulnerability
Shell
OSCP Cheat Sheet
oscp oscp-guide cheat-sheet cheatsheet offensive offensive-security offsec penetration-testing pentesting security
Python Shell C PHP PowerShell ASP.NET
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-30088 vulnerability anywhere in the article.
-
Cybersecurity News
Earth Estries’ Evolving Toolkit: A Deep Dive into Their Advanced Techniques
Trend Micro has uncovered details about a sophisticated cyberespionage campaign from Earth Estries, also known as Salt Typhoon. Active since 2020, Earth Estries primarily targets governments and techn ... Read more
-
The Hacker News
THN Cybersecurity Recap: Top Threats, Tools and News (Oct 14 - Oct 20)
Cybersecurity / Weekly Recap Hi there! Here's your quick update on the latest in cybersecurity. Hackers are using new tricks to break into systems we thought were secure—like finding hidden doors in l ... Read more
-
SentinelOne
The Good, the Bad and the Ugly in Cybersecurity – Week 42
The Good | DoJ Unseals Indictment Against Notorious ‘Anonymous Sudan’ DDoS Operators An unsealed indictment charged two brothers with operating the hacktivist group ‘Anonymous Sudan’, responsible for ... Read more
-
SentinelOne
The Good, the Bad and the Ugly in Cybersecurity – Week 42
The Good | DoJ Unseals Indictment Against Notorious ‘Anonymous Sudan’ DDoS Operators An unsealed indictment charged two brothers with operating the hacktivist group ‘Anonymous Sudan’, responsible for ... Read more
-
Dark Reading
Iran's APT34 Abuses MS Exchange to Spy on Gulf Gov'ts
Source: Daniren via Alamy Stock PhotoAn Iranian threat actor has been ramping up its espionage against Gulf-state government entities, particularly those within the United Arab Emirates (UAE).APT34 (a ... Read more
-
The Cyber Express
SolarWinds, Firefox, Windows Face Active Exploitation: CISA Issues Urgent Warning
The Cybersecurity and Infrastructure Security Agency (CISA) has recently added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, emphasizing the pressing need for organizatio ... Read more
-
BleepingComputer
SolarWinds Web Help Desk flaw is now exploited in attacks
CISA has added three flaws to its 'Known Exploited Vulnerabilities' (KEV) catalog, among which is a critical hardcoded credentials flaw in SolarWinds Web Help Desk (WHD) that the vendor fixed in late ... Read more
-
TheCyberThrone
CISA KEV Catalog Update Part IV – October 2024
The US CISA has added below vulnerabilities to its Known Exploited Vulnerabilities Catalog based on the evidence of active exploitation.CVE-2024-30088 Microsoft Windows Kernel contains a time-of-check ... Read more
-
Cybersecurity News
Earth Simnavaz Exploits Windows Kernel Flaw CVE-2024-30088 in Attacks on Critical Infrastructure
Attack chain | Image: Trend MicroTrend Micro researchers have uncovered a series of advanced cyberattacks carried out by the threat group Earth Simnavaz, also known as APT34 or OilRig. This Iranian-li ... Read more
-
BleepingComputer
Iranian hackers now exploit Windows flaw to elevate privileges
The Iranian state-sponsored hacking group APT34, aka OilRig, has recently escalated its activities with new campaigns targeting government and critical infrastructure entities in the United Arab Emira ... Read more
-
The Hacker News
OilRig Exploits Windows Kernel Flaw in Espionage Campaign Targeting UAE and Gulf
The Iranian threat actor known as OilRig has been observed exploiting a now-patched privilege escalation flaw impacting the Windows Kernel as part of a cyber espionage campaign targeting the U.A.E. an ... Read more
-
Trend Micro
Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East
APT & Targeted Attacks Trend Micro's investigation into the recent activity of Earth Simnavaz provides new insights into the APT group’s evolving tactics and the immediate threat it poses to sectors i ... Read more
The following table lists the changes that have been made to the
CVE-2024-30088 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Oct. 16, 2024
Action Type Old Value New Value Added Due Date 2024-11-05 Added Date Added 2024-10-15 Added Vulnerability Name Microsoft Windows Kernel TOCTOU Race Condition Vulnerability Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. -
Initial Analysis by [email protected]
Jun. 21, 2024
Action Type Old Value New Value Changed Reference Type https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088 No Types Assigned https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088 Patch, Vendor Advisory Added CWE NIST CWE-367 Added CPE Configuration OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.10240.20680 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7070 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.5936 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.4529 *cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19045.4529 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.3019 *cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22621.3737 *cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22631.3737 *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.7070 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.5936 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.2522 *cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.25398.950 -
CVE Modified by [email protected]
Jun. 20, 2024
Action Type Old Value New Value -
CVE Modified by [email protected]
Jun. 17, 2024
Action Type Old Value New Value -
CVE Received by [email protected]
Jun. 11, 2024
Action Type Old Value New Value Added Description Windows Kernel Elevation of Privilege Vulnerability Added Reference Microsoft Corporation https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30088 [No types assigned] Added CWE Microsoft Corporation CWE-367 Added CVSS V3.1 Microsoft Corporation AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-30088 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-30088
weaknesses.