CVE-2024-38264

Sensitive Data Storage in Improperly Locked Memory (CWE-591)

Published: Nov 12, 2024

010
CVSS 5.9EPSS 0.05%Medium
CVE info copied to clipboard

Summary

Microsoft Virtual Hard Disk (VHDX) Denial of Service Vulnerability. This is a network-based vulnerability with high attack complexity that can lead to a high impact on system availability. The vulnerability requires no user interaction or privileges to exploit.

Impact

This vulnerability allows an unauthenticated attacker to cause a denial of service condition in systems using Microsoft Virtual Hard Disk (VHDX). The attack can be launched remotely over a network, although it requires a high level of complexity to execute. If successful, it can severely impact the availability of the affected system, potentially causing disruptions to services or operations dependent on VHDX.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Microsoft has released an official fix for this vulnerability on November 12, 2024.

Mitigation

1. Apply the official patch released by Microsoft as soon as possible. 2. Monitor systems for any unusual activity or performance issues related to VHDX usage. 3. Implement network segmentation to limit exposure of systems using VHDX to untrusted networks. 4. Consider implementing additional network security controls to filter potentially malicious traffic targeting VHDX systems. 5. Keep all systems and software up to date with the latest security patches.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-38264. See article

Jun 18, 2024 at 12:55 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Jun 18, 2024 at 12:55 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (92186)

Nov 12, 2024 at 7:53 AM
CVSS

A CVSS base score of 5.9 has been assigned.

Nov 12, 2024 at 5:55 PM / microsoft
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Nov 12, 2024 at 5:57 PM
CVE Assignment

NVD published the first details for CVE-2024-38264

Nov 12, 2024 at 6:15 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 18.3%)

Nov 13, 2024 at 5:06 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 18.3%)

Nov 18, 2024 at 6:29 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/windows_11_22h2
+null more

Patches

Microsoft
+null more

References

Microsoft Virtual Hard Disk (VHDX) Denial of Service Vulnerability
Successful exploitation of this vulnerability requires an attacker to win a race condition. According to the CVSS metric, the attack complexity is high (AC:H).
CVE-2024-38264 - Security Update Guide - Microsoft - Microsoft Virtual Hard Disk (VHDX) Denial of Service Vulnerability
There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

News

2024-45 - Adobe, Mozilla, Canonical, Red Hat, Microsoft, Google, Jenkins, GitHub, Spring 🗂️
Advisory Week Week 45, 2024 National Cyber Awareness System CISA Releases Nineteen Industrial Control Systems Advisories CISA Adds Two Known Exploited Vulnerabilities to Catalog Palo Alto Networks Emphasizes Hardening Guidance Fortinet Releases Security Updates for Multiple Products Microsoft Releases November 2024 Security Updates Adobe Releases Security Updates for Multiple Products Ivanti Releases Security Updates for Multiple Products JCDC’s Collaborative Efforts Enhance Cybersecurity for the 2024 Olympic and Paralympic Games Citrix Releases Security Updates for NetScaler and Citrix Session Recording CISA Releases Five Industrial Control Systems Advisories CISA, FBI, NSA, and International Partners Release Joint Advisory on 2023 Top Routinely Exploited Vulnerabilities CISA Adds Five Known Exploited Vulnerabilities to Catalog Adobe Security Bulletins and Advisories Security updates available for Adobe Photoshop APSB24-89 Security Updates Available for Adobe Commerce APSB24-90 Security Updates Available for Adobe Illustrator APSB24-66 APSB24-87 Security Update Available for Adobe InDesign APSB24-88 Security Updates Available for Adobe Bridge APSB24-77 Security Updates Available for Adobe Audition APSB24-83 Mozilla Security Advisories Security Vulnerabilities fixed in Thunderbird 132.0.1 mfsa2024-62 Security Vulnerabilities fixed in Thunderbird 128.4.3 mfsa2024-61 Ubuntu Security Notices Linux kernel vulnerabilities: USN-7089-6 / USN-7088-5 / USN-7089-5 / USN-7110-1 / USN-7089-4 / USN-7100-2 / USN-7100-1 GD Graphics Library vulnerability: USN-7112-1 Go vulnerabilities: USN-7111-1 / USN-7109-1 Linux kernel vulnerability:
Microsoft’s Security Update in November on High-Risk Vulnerabilities in Multiple Products
On November 13, NSFOCUS CERT detected that Microsoft released a security update patch for November, which fixed 89 security issues, including Windows, Microsoft SQL Server, Microsoft Office, Azure, Open Source Software, Microsoft Visual Studio, System Center and other widely used products, including high-risk vulnerabilities such as privilege escalation vulnerability and remote code execution vulnerability. Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
1.771
Atlassian Confluence Server CVE-2023-22505 Remote Code Execution Vulnerability Atlassian Confluence Server CVE-2023-22508 Remote Code Execution Vulnerability
Patch Tuesday November 2024 - 3 Zero Days!
So, without further ado, here’s the chart of MS patches that affect Windows platforms in the past month. Of this months patches only 8 are critical and 88 important.
November Patch Tuesday loads up everyone’s plate – Sophos News
We are as always including at the end of this post additional appendices listing all Microsoft’s patches, sorted by severity, by predicted exploitability, and by product family. This Important-severity spoofing vulnerability, which Microsoft believes to be more likely to be exploited within the next 30 days, has a rather specific set of post-installation instructions, which can be seen on the company’s site.
See 25 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:High
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:None
Integrity:None
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI