Heap-based Buffer Overflow (CWE-122)
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability. This is a local vulnerability with low attack complexity and requires low privileges. It has high impact on confidentiality, integrity, and availability.
This vulnerability allows an attacker with low privileges to elevate their privileges on the system. The attacker could potentially gain full control over the affected system, compromising the confidentiality, integrity, and availability of data and resources. This could lead to unauthorized access to sensitive information, modification of system files, or disruption of services.
There is no evidence that a public proof-of-concept exists. Its exploitation has been reported by various sources, including securityonline.info.
A patch is available. Microsoft released an official fix for this vulnerability on July 9, 2024.
1. Apply the official patch released by Microsoft as soon as possible. 2. Implement the principle of least privilege, ensuring users and processes have only the minimum necessary permissions. 3. Monitor for suspicious activities, especially attempts to elevate privileges. 4. Keep all Microsoft systems and software up to date with the latest security patches. 5. Use endpoint detection and response (EDR) tools to detect and prevent exploitation attempts.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Detection for the vulnerability has been added to Qualys (92149)
NVD published the first details for CVE-2024-38054
Feedly found the first article mentioning CVE-2024-38054. See article
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.04% (Percentile: 9.2%)
Attacks in the wild have been reported by Cybersecurity News. See article
CVE-2024-38054 is a critical vulnerability that allows for out-of-bounds access due to unchecked length or index issues. @Fr0st1706 has already written an exploit for this vulnerability, indicating that it may be exploited in the wild. It is important for organizations to implement mitigations, detections, and patches to prevent potential impacts on third party vendors or technology. See article