CVE-2024-43452

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

Published: Nov 12, 2024

010
CVSS 7.5EPSS 0.09%High
CVE info copied to clipboard

Summary

Windows Registry Elevation of Privilege Vulnerability. This vulnerability is related to a Time-of-check Time-of-use (TOCTOU) Race Condition, which can be exploited to gain elevated privileges in the Windows Registry. The attack vector is network-based, requires user interaction, and has a high attack complexity.

Impact

If successfully exploited, this vulnerability could lead to a significant impact on the affected systems. The CVSS v3.1 base score is 7.5, indicating a high severity. The impact on confidentiality, integrity, and availability is all rated as HIGH. An attacker who successfully exploits this vulnerability could potentially gain elevated privileges, allowing them to read, modify, or delete sensitive data in the Windows Registry, execute arbitrary code with higher privileges, or disrupt system operations.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available for this vulnerability. Microsoft released the patch on November 12, 2024. The security team should prioritize applying this patch to affected Windows systems.

Mitigation

To mitigate this vulnerability, the following steps are recommended: 1. Apply the security update provided by Microsoft as soon as possible. 2. Implement the principle of least privilege to minimize the potential impact of successful exploits. 3. Educate users about the risks of interacting with untrusted network sources, as user interaction is required for exploitation. 4. Monitor systems for any suspicious activities related to Windows Registry modifications or privilege escalation attempts. 5. Implement network segmentation to limit the potential spread of an attack if a system is compromised. 6. Regularly audit and monitor Windows Registry access and changes. 7. Keep all Windows systems and software up to date with the latest security patches.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (92186)

Nov 12, 2024 at 7:53 AM
CVSS

A CVSS base score of 7.5 has been assigned.

Nov 12, 2024 at 5:55 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-43452. See article

Nov 12, 2024 at 6:00 PM / Microsoft Security Advisories - MSRC
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 12, 2024 at 6:02 PM
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Nov 12, 2024 at 6:13 PM
CVE Assignment

NVD published the first details for CVE-2024-43452

Nov 12, 2024 at 6:15 PM
EPSS

EPSS Score was set to: 0.09% (Percentile: 40.2%)

Nov 13, 2024 at 5:06 PM
Trending

This CVE started to trend in security discussions

Nov 13, 2024 at 6:09 PM
Trending

This CVE stopped trending in security discussions

Nov 15, 2024 at 6:25 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/windows_server_2019
+null more

Patches

Microsoft
+null more

Attack Patterns

CAPEC-27: Leveraging Race Conditions via Symbolic Links
+null more

References

Windows Registry Elevation of Privilege Vulnerability
According to the CVSS metric, user interaction is required (UI:R). What privileges could be gained by an attacker who successfully exploited this vulnerability?

News

cveNotify : 🚨 CVE-2024-43452Windows Registry Elevation of Privilege Vulnerability🎖@cveNotify
cveNotify : 🚨 CVE-2024-43452Windows Registry Elevation of Privilege Vulnerability🎖@cveNotify
2024-45 - Adobe, Mozilla, Canonical, Red Hat, Microsoft, Google, Jenkins, GitHub, Spring 🗂️
Advisory Week Week 45, 2024 National Cyber Awareness System CISA Releases Nineteen Industrial Control Systems Advisories CISA Adds Two Known Exploited Vulnerabilities to Catalog Palo Alto Networks Emphasizes Hardening Guidance Fortinet Releases Security Updates for Multiple Products Microsoft Releases November 2024 Security Updates Adobe Releases Security Updates for Multiple Products Ivanti Releases Security Updates for Multiple Products JCDC’s Collaborative Efforts Enhance Cybersecurity for the 2024 Olympic and Paralympic Games Citrix Releases Security Updates for NetScaler and Citrix Session Recording CISA Releases Five Industrial Control Systems Advisories CISA, FBI, NSA, and International Partners Release Joint Advisory on 2023 Top Routinely Exploited Vulnerabilities CISA Adds Five Known Exploited Vulnerabilities to Catalog Adobe Security Bulletins and Advisories Security updates available for Adobe Photoshop APSB24-89 Security Updates Available for Adobe Commerce APSB24-90 Security Updates Available for Adobe Illustrator APSB24-66 APSB24-87 Security Update Available for Adobe InDesign APSB24-88 Security Updates Available for Adobe Bridge APSB24-77 Security Updates Available for Adobe Audition APSB24-83 Mozilla Security Advisories Security Vulnerabilities fixed in Thunderbird 132.0.1 mfsa2024-62 Security Vulnerabilities fixed in Thunderbird 128.4.3 mfsa2024-61 Ubuntu Security Notices Linux kernel vulnerabilities: USN-7089-6 / USN-7088-5 / USN-7089-5 / USN-7110-1 / USN-7089-4 / USN-7100-2 / USN-7100-1 GD Graphics Library vulnerability: USN-7112-1 Go vulnerabilities: USN-7111-1 / USN-7109-1 Linux kernel vulnerability:
Microsoft’s Security Update in November on High-Risk Vulnerabilities in Multiple Products
On November 13, NSFOCUS CERT detected that Microsoft released a security update patch for November, which fixed 89 security issues, including Windows, Microsoft SQL Server, Microsoft Office, Azure, Open Source Software, Microsoft Visual Studio, System Center and other widely used products, including high-risk vulnerabilities such as privilege escalation vulnerability and remote code execution vulnerability. Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
1.771
Atlassian Confluence Server CVE-2023-22505 Remote Code Execution Vulnerability Atlassian Confluence Server CVE-2023-22508 Remote Code Execution Vulnerability
Patch Tuesday November 2024 - 3 Zero Days!
So, without further ado, here’s the chart of MS patches that affect Windows platforms in the past month. Of this months patches only 8 are critical and 88 important.
See 26 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:High
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI