Microsoft Technical Security Notifications</a> and <a href=https://feedly.com/cve/"https://msrc-blog.microsoft.com/2022/08/09/security-update-guide-notification-system-news-create-your-profile-now/">Security Update Guide Notification System News: Create your profile now – Microsoft Security Response Center</a>.</p> <p>Microsoft is not aware of any attempts to exploit this vulnerability. However, a public presentation regarding this vulnerability was hosted at BlackHat on August 7, 2024. The presentation was appropriately coordinated with Microsoft but may change the threat landscape. Customers concerned with these risks should reference the guidance provided in the <strong>Recommended Actions</strong> section to protect their systems.</p> <h2 id="recommended-actions">Recommended Actions</h2> <p>The following recommendations do not mitigate the vulnerability but can be used to reduce the risk of exploitation until the security update is available.</p> <ul> <li><p>Audit users with permission to perform Backup and Restore operations to ensure only the appropriate users can perform these operations.</p> <ul> <li><a href=https://feedly.com/cve/"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege">Audit: Audit the use of Backup and Restore privilege (Windows 10) - Windows 10 | Microsoft Learn</a></li> </ul> </li> <li><p>Implement an Access Control List or Discretionary Access Control Lists to restrict the access or modification of Backup files and perform Restore operations to appropriate users, for example administrators only.</p> <ul> <li><a href=https://feedly.com/cve/"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-sensitive-privilege-use">Access Control overview | Microsoft Learn</a></li> <li><a href=https://feedly.com/cve/"https://learn.microsoft.com/en-us/windows/win32/secbp/creating-a-dacl">Discretionary Access Control Lists (DACL)</a></li> </ul> </li> <li><p>Auditing sensitive privileges used to identify access, modification, or replacement of Backup related files could help indicate attempts to exploit this vulnerability.</p> <ul> <li><a href=https://feedly.com/cve/"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-sensitive-privilege-use">Audit Sensitive Privilege Use - Windows 10 | Microsoft Learn</a></li> </ul> </li> </ul> CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C"/>Microsoft Technical Security Notifications</a> and <a href=https://feedly.com/cve/"https://msrc-blog.microsoft.com/2022/08/09/security-update-guide-notification-system-news-create-your-profile-now/">Security Update Guide Notification System News: Create your profile now – Microsoft Security Response Center</a>.</p> <p>Microsoft is not aware of any attempts to exploit this vulnerability. However, a public presentation regarding this vulnerability was hosted at BlackHat on August 7, 2024. The presentation was appropriately coordinated with Microsoft but may change the threat landscape. Customers concerned with these risks should reference the guidance provided in the <strong>Recommended Actions</strong> section to protect their systems.</p> <h2 id="recommended-actions">Recommended Actions</h2> <p>The following recommendations do not mitigate the vulnerability but can be used to reduce the risk of exploitation until the security update is available.</p> <ul> <li><p>Audit users with permission to perform Backup and Restore operations to ensure only the appropriate users can perform these operations.</p> <ul> <li><a href=https://feedly.com/cve/"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege">Audit: Audit the use of Backup and Restore privilege (Windows 10) - Windows 10 | Microsoft Learn</a></li> </ul> </li> <li><p>Implement an Access Control List or Discretionary Access Control Lists to restrict the access or modification of Backup files and perform Restore operations to appropriate users, for example administrators only.</p> <ul> <li><a href=https://feedly.com/cve/"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-sensitive-privilege-use">Access Control overview | Microsoft Learn</a></li> <li><a href=https://feedly.com/cve/"https://learn.microsoft.com/en-us/windows/win32/secbp/creating-a-dacl">Discretionary Access Control Lists (DACL)</a></li> </ul> </li> <li><p>Auditing sensitive privileges used to identify access, modification, or replacement of Backup related files could help indicate attempts to exploit this vulnerability.</p> <ul> <li><a href=https://feedly.com/cve/"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-sensitive-privilege-use">Audit Sensitive Privilege Use - Windows 10 | Microsoft Learn</a></li> </ul> </li> </ul> CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C"/>
Improper Access Control (CWE-284)
An elevation of privilege vulnerability exists in Windows Backup, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS). For exploitation to succeed, an attacker must trick or convince an Administrator or a user with delegated permissions into performing a system restore which inadvertently triggers the vulnerability.
If successfully exploited, this vulnerability could allow an attacker with basic user privileges to elevate their privileges, potentially reintroducing previously mitigated vulnerabilities or circumventing some features of Virtualization Based Security (VBS). This could lead to compromised system integrity and potentially impact the confidentiality and availability of the affected system. The CVSS v3.1 base score for this vulnerability is 7.3 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, indicating high impacts on confidentiality, integrity, and availability.
There is no evidence that a public proof-of-concept exists. Its exploitation has been reported by various sources, including helpnetsecurity.com.
A patch is currently not available. Microsoft is developing a security update to mitigate this vulnerability, but it has not yet been released. The CVE will be updated with new information and links to the security updates once available.
While no official patch is available, Microsoft recommends the following actions to reduce the risk of exploitation: 1. Audit users with permission to perform Backup and Restore operations. 2. Implement Access Control Lists or Discretionary Access Control Lists to restrict access or modification of Backup files and perform Restore operations to appropriate users (e.g., administrators only). 3. Audit sensitive privileges used to identify access, modification, or replacement of Backup-related files to help detect potential exploitation attempts. Additionally, customers are encouraged to subscribe to Security Update Guide notifications to be alerted when the official patch becomes available.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
Feedly found the first article mentioning CVE-2024-38202. See article
Feedly estimated the CVSS score as MEDIUM
Feedly estimated the CVSS score as HIGH
CVE-2024-38202 is a critical vulnerability with a CVSS score of 9.8 that affects Microsoft products. If exploited in the wild, threat actors could gain unauthorized access to sensitive information. While there are no proof-of-concept exploits currently available, Microsoft has released patches to mitigate the vulnerability and prevent potential downstream impacts on third-party vendors. See article
NVD published the first details for CVE-2024-38202
Attacks in the wild have been reported by Help Net Security. See article
This CVE started to trend in security discussions
This CVE stopped trending in security discussions
EPSS Score was set to: 0.05% (Percentile: 18.9%)