CVE-2024-38125
Numeric Truncation Error (CWE-197)
Summary
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability in Microsoft systems. This is a local vulnerability with a low attack complexity and requires low privileges to exploit. It does not require user interaction.
Impact
Successful exploitation of this vulnerability could lead to a high impact on confidentiality, integrity, and availability of the affected system. An attacker who successfully exploits this vulnerability could gain elevated privileges on the targeted system, potentially allowing them to execute arbitrary code with system-level privileges, access or modify sensitive data, or disrupt system operations.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft has released an official fix for this vulnerability on August 13, 2024.
Mitigation
1. Apply the official patch released by Microsoft as soon as possible. 2. Implement the principle of least privilege, ensuring users and applications operate with minimal necessary permissions. 3. Monitor and restrict local access to systems, as the vulnerability requires local access to exploit. 4. Keep all Microsoft systems and software up to date with the latest security updates. 5. Implement robust access controls and user authentication mechanisms. 6. Use endpoint detection and response (EDR) solutions to monitor for suspicious activities that might indicate exploitation attempts.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Timeline
Detection for the vulnerability has been added to Qualys (92160)
Feedly found the first article mentioning CVE-2024-38125. See article
NVD published the first details for CVE-2024-38125
CVE-2024-38125 is a critical vulnerability with a CVSS score of 7.8 affecting Microsoft Streaming Service. It is currently being exploited in the wild by threat actors, and there are proof-of-concept exploits available. Mitigations, detections, and patches have not been released yet, potentially impacting other third-party vendors and technologies relying on the service. See article
EPSS Score was set to: 0.05% (Percentile: 19%)