Use After Free (CWE-416)
Windows Storage Elevation of Privilege Vulnerability. This is a Use After Free vulnerability affecting various versions of Windows operating systems, including Windows 10, Windows 11, and Windows Server 2022.
This vulnerability could allow an attacker with low privileges to elevate their privileges on the affected system. If successfully exploited, it could lead to high impacts on confidentiality, integrity, and availability of the system. The attacker could potentially gain full control over the affected Windows system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patches are available. Microsoft has released security updates to address this vulnerability. The patches were initially made available on September 10, 2024.
1. Apply the security updates provided by Microsoft as soon as possible. 2. Ensure that all affected Windows systems are updated to versions newer than those listed: - Windows 10 22H2: 10.0.19045.4894 - Windows 11 22H2: 10.0.22621.4169 - Windows Server 2022: 10.0.20348.2700 - Windows 11 24H2: 10.0.26100.1742 - Windows 11 21H2: 10.0.22000.3197 - Windows 10 21H2: 10.0.19044.4894 - Windows Server 2022 23H2: 10.0.25398.1128 - Windows 11 23H2: 10.0.22621.4169 (ARM64) and 10.0.22631.4169 (x64) 3. Implement the principle of least privilege, ensuring users operate with minimal necessary permissions. 4. Monitor for suspicious activities or unauthorized elevation of privileges on affected systems. 5. Keep all Windows systems and software up to date with the latest security patches as a general best practice.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Detection for the vulnerability has been added to Qualys (92169)
A CVSS base score of 7 has been assigned.
Feedly found the first article mentioning CVE-2024-38248. See article
Feedly estimated the CVSS score as MEDIUM
NVD published the first details for CVE-2024-38248
EPSS Score was set to: 0.04% (Percentile: 9.6%)
EPSS Score was set to: 0.06% (Percentile: 26.7%)