CVE-2024-38249
Use After Free (CWE-416)
Published: Sep 10, 2024
010
CVSS 7.8EPSS 0.04%High
CVE info copied to clipboard
Summary
Windows Graphics Component Elevation of Privilege Vulnerability. This vulnerability is classified as a Use After Free (CWE-416) issue, which can lead to improper privilege management (CWE-269). It affects various versions of Windows operating systems, including Windows 10, Windows 11, and Windows Server editions.
Impact
This vulnerability has a high severity with a CVSS v3.1 base score of 7.8. It can potentially allow an attacker with low privileges to execute code with elevated system privileges, leading to a complete compromise of the affected system's confidentiality, integrity, and availability. The attack vector is local, requires low attack complexity, and does not need user interaction, making it relatively easy to exploit once an attacker has local access to the system.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
Patches are available. Microsoft has released updates to address this vulnerability. The patches were first made available on September 10, 2024. Users should update their systems to the following versions or later, depending on their Windows edition: - Windows 10 (1809): 10.0.17763.6293 - Windows 11 (21H2): 10.0.22000.3197 - Windows 10 (21H2): 10.0.19044.4894 - Windows Server 2022 (23H2): 10.0.25398.1128 - Windows 11 (22H2): 10.0.22621.4169 - Windows 10 (22H2): 10.0.19045.4894 - Windows Server 2022: 10.0.20348.2700 - Windows 11 (24H2): 10.0.26100.1742 - Windows 10 (1507): 10.0.10240.20766 - Windows 10 (1607): 10.0.14393.7336 - Windows Server 2019: 10.0.17763.6293 - Windows Server 2016: 10.0.14393.7336 Other affected versions of Windows, including Windows Server 2008, 2012, and Windows 11 (23H2), should also be updated to the latest available versions.
Mitigation
1. Apply the security updates provided by Microsoft as soon as possible. 2. Implement the principle of least privilege, ensuring users and applications operate with minimal necessary permissions. 3. Restrict local access to systems, as the vulnerability requires local access to exploit. 4. Keep all Windows systems and software up to date with the latest security patches. 5. Use endpoint detection and response (EDR) solutions to monitor for suspicious activities that might indicate exploitation attempts. 6. Implement application whitelisting to prevent unauthorized code execution. 7. Regularly audit user privileges and remove unnecessary elevated permissions. 8. Consider using Windows Defender Application Control (WDAC) policies to control which applications can run on your Windows systems.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Timeline
Detection in Vulnerability Scanners
Detection for the vulnerability has been added to Qualys (92169)
Sep 10, 2024 at 7:53 AM
CVSS
A CVSS base score of 7.8 has been assigned.
Sep 10, 2024 at 4:55 PM / microsoft
First Article
Feedly found the first article mentioning CVE-2024-38249. See article
Sep 10, 2024 at 5:00 PM / Microsoft Security Advisories - MSRC
CVSS Estimate
Feedly estimated the CVSS score as MEDIUM
Sep 10, 2024 at 5:00 PM
CVE Assignment
NVD published the first details for CVE-2024-38249
Sep 10, 2024 at 5:15 PM
Detection in Vulnerability Scanners
Detection for the vulnerability has been added to Nessus (206891)
Sep 10, 2024 at 11:17 PM
EPSS
EPSS Score was set to: 0.04% (Percentile: 9.6%)
Sep 11, 2024 at 10:12 AM
EPSS
EPSS Score was set to: 0.06% (Percentile: 26.8%)
Nov 19, 2024 at 2:58 PM
Affected Systems
Microsoft/windows_10_1809
+null more
Patches
Microsoft
+null more
References
September 2024 Security Updates - Release Notes - Security Update Guide - Microsoft
Windows TCP/IP CVE-2024-21416 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-26186 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-26191 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Security Zone Mapping CVE-2024-30073 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37335 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37337 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37338 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37339 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37340 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37341 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37342 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37965 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37966 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37980 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Installer CVE-2024-38014 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Detected Yes No No Microsoft Office SharePoint CVE-2024-38018 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Windows TCP/IP CVE-2024-38045 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows PowerShell CVE-2024-38046 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Network Address Translation (NAT) CVE-2024-38119 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Azure Network Watcher CVE-2024-38188 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Azure Web Apps CVE-2024-38194 8.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Azure Stack CVE-2024-38216 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Mark of the Web (MOTW) CVE-2024-38217 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:F/RL:O/RC:C Exploitation Detected Yes No No Azure Stack CVE-2024-38220 9.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Dynamics Business Central CVE-2024-38225 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Microsoft Office Publisher CVE-2024-38226 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Detected Yes No No Microsoft Office SharePoint CVE-2024-38227 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Microsoft Office SharePoint CVE-2024-38228 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Windows Standards-Based Storage Management Service CVE-2024-38230 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitation Less Likely No No No Windows Remote Desktop Licensing Service CVE-2024-38231 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Network Virtualization CVE-2024-38232 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitation Less Likely No No No Windows Network Virtualization CVE-2024-38233 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitation Less Likely No No No Windows Network Virtualization CVE-2024-38234 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Role: Windows Hyper-V CVE-2024-38235 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows DHCP Server CVE-2024-38236 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitation Less Likely No No No Microsoft Streaming Service CVE-2024-38237 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Microsoft Streaming Service CVE-2024-38238 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Windows Kerberos CVE-2024-38239 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Remote Access Connection Manager CVE-2024-38240 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Microsoft Streaming Service CVE-2024-38241 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Microsoft Streaming Service CVE-2024-38242 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Microsoft Streaming Service CVE-2024-38243 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Microsoft Streaming Service CVE-2024-38244 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Microsoft Streaming Service CVE-2024-38245 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Windows Win32K - GRFX CVE-2024-38246 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Microsoft Graphics Component CVE-2024-38247 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Windows Storage CVE-2024-38248 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C Exploitation Less Likely Yes No No Microsoft Graphics Component CVE-2024-38249 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Microsoft Graphics Component CVE-2024-38250 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Win32K - ICOMP CVE-2024-38252 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Windows Win32K - ICOMP CVE-2024-38253 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Windows Authentication Methods CVE-2024-38254 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Kernel-Mode Drivers CVE-2024-38256 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows AllJoyn API CVE-2024-38257 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Remote Desktop Licensing Service CVE-2024-38258 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Microsoft Management Console CVE-2024-38259 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Remote Desktop Licensing Service CVE-2024-38260 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Remote Desktop Licensing Service CVE-2024-38263 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Remote Desktop Licensing Service CVE-2024-43454 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Remote Desktop Licensing Service CVE-2024-43455 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Setup and Deployment CVE-2024-43457 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Windows Network Virtualization CVE-2024-43458 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows MSHTML Platform CVE-2024-43461 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Microsoft Office Visio CVE-2024-43463 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Microsoft Office SharePoint CVE-2024-43464 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation More Likely Yes No No Microsoft Office Excel CVE-2024-43465 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Microsoft Office SharePoint CVE-2024-43466 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C Exploitation Less Likely No No No Windows Remote Desktop Licensing Service CVE-2024-43467 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Azure CycleCloud CVE-2024-43469 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Azure Network Watcher CVE-2024-43470 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-43474 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Admin Center CVE-2024-43475 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Microsoft Dynamics 365 (on-premises) CVE-2024-43476 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Power Automate CVE-2024-43479 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Microsoft Outlook for iOS CVE-2024-43482 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Mark of the Web (MOTW) CVE-2024-43487 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C Exploitation More Likely Yes No No Windows Update CVE-2024-43491 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Detected Yes No No Microsoft AutoUpdate (MAU) CVE-2024-43492 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Libarchive CVE-2024-43495 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No
Windows Graphics Component Elevation of Privilege Vulnerability
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
News
CVE-2024-38249 Windows Graphics Component Elevation of Privilege Vulnerability
ZDI-24-1291: Microsoft Windows Device Context Improper Release Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
September 2024 – Microsoft Patch Tuesday Highlights
Spoofing, Denial of Service (DoS), Elevation of Privilege (EoP), Information Disclosure, Security Feature Bypass, and Remote Code Execution (RCE) are among the vulnerabilities that Microsoft has addressed in several software products. Updates for vulnerabilities in Microsoft Office and Components, Windows Hyper-V, Windows DHCP Server, Microsoft Streaming Service, Microsoft Management Console, Windows MSHTML Platform, Microsoft Dynamics 365 (on-premises), and other areas are included in the September edition of Microsoft Patch Tuesday.
September Patch Tuesday addresses 79 CVEs – Sophos News
In addition to these patches, the release includes advisory information on three CVEs addressed by patches from Adobe, affecting Reader and ColdFusion; one of the Reader vulnerabilities CVE-2024-41869) is a critical-severity use-after-free with a workable exploit already available in the wild. The bad news, for those still running either of those versions, is that critical-severity remote code execution issue, which carries a 9.8 CVE base score, occurs in… the Windows Servicing Stack.
Patch Tuesday September 2024: Upcoming Automatic Windows 11 22H2 Feature Update and EoS Windows 10 Security Update
September’s Patch Tuesday brings fixes for 79 vulnerabilities, four zero days Under Active Exploitation, seven Critical Vulnerabilities, and a Hot Patch ( KB5042880 )—this was made available for Window Server 2022 to address CVE-2020-17042 that was originally patched in November 2020. Elsewhere, with CVE-2024-43491 existing in Windows 10 version 1507, this illustrates the rare occurrence when Microsoft will make a Security Update available to address a vulnerability for an end of support version of Windows.
See 37 more articles and social media posts