CVE-2024-38086
Numeric Truncation Error (CWE-197)
Summary
Azure Kinect SDK Remote Code Execution Vulnerability. This is a high-severity vulnerability affecting the Azure Kinect SDK. It has a CVSS v3.1 base score of 6.4, indicating a high level of risk. The vulnerability is related to a Numeric Truncation Error (CWE-197). The affected product is Microsoft Azure Kinect Software Development Kit, versions prior to 1.4.2.
Impact
If exploited, this vulnerability could lead to remote code execution, potentially allowing an attacker to execute arbitrary code on the affected system. The vulnerability has high impacts on confidentiality, integrity, and availability. This means an attacker could potentially access sensitive information, modify data, or disrupt system operations. The attack vector is physical, requiring physical access to the system, and the attack complexity is high. No user interaction is required for exploitation, and no privileges are needed to execute the attack.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft released a security update on July 9, 2024, to address this vulnerability. The patch updates the Azure Kinect SDK to version 1.4.2 or later.
Mitigation
1. Apply the security update provided by Microsoft as soon as possible, upgrading to Azure Kinect SDK version 1.4.2 or later. 2. Limit physical access to systems using the Azure Kinect SDK, as the attack vector is physical. 3. Monitor for any unusual activities or unauthorized access attempts on systems using the Azure Kinect SDK. 4. Ensure that the principle of least privilege is applied to all systems and users interacting with the Azure Kinect SDK. 5. Consider implementing additional security measures such as network segmentation to isolate systems running the vulnerable software.
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
A CVSS base score of 6.4 has been assigned.
NVD published the first details for CVE-2024-38086
Feedly found the first article mentioning CVE-2024-38086. See article
Feedly estimated the CVSS score as HIGH
This CVE started to trend in security discussions
EPSS Score was set to: 0.05% (Percentile: 21.9%)
This CVE stopped trending in security discussions