Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
A Kernel Streaming Service Driver Elevation of Privilege Vulnerability has been identified in multiple versions of Microsoft Windows. This vulnerability is related to a race condition, specifically involving concurrent execution using shared resources with improper synchronization.
If exploited, this vulnerability could allow an attacker with low privileges to elevate their privileges on the affected system. The impact is severe, with potential for high levels of compromise to confidentiality, integrity, and availability of the system. An attacker could potentially gain administrative control, access sensitive information, modify system settings, or disrupt normal operations.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patches are available. Microsoft has released updates to address this vulnerability across multiple affected Windows versions, including Windows 10, Windows 11, and various Windows Server editions.
1. Apply the latest security updates provided by Microsoft for the affected Windows versions. 2. Ensure that all Windows systems are updated to the following versions or newer: - Windows 10 version 22H2: 10.0.19045.4651 - Windows 11 version 22H2: 10.0.22621.3880 - Windows Server 2012 R2: Latest update - Windows Server 2022 version 23H2: 10.0.25398.1009 - Windows 11 version 21H2: 10.0.22000.3079 - Windows Server 2019: 10.0.17763.6054 - Windows Server 2016: 10.0.14393.7159 - Windows 10 version 21H2: 10.0.19044.4651 - Windows 11 version 23H2: 10.0.22631.3880 - Windows 10 version 1607: 10.0.14393.7159 - Windows Server 2008 R2 SP1 and Windows Server 2008 SP2: Latest update - Windows Server 2022: 10.0.20348.2582 - Windows 10 version 1809: 10.0.17763.6054 3. Implement the principle of least privilege to minimize the potential impact of successful exploits. 4. Monitor systems for unusual activity or unauthorized elevation of privileges. 5. Keep all Windows systems and software up to date with the latest security patches as they become available.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
A CVSS base score of 7.8 has been assigned.
Feedly found the first article mentioning CVE-2024-38191. See article
NVD published the first details for CVE-2024-38191
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.05% (Percentile: 19%)