CVE-2024-24853

What it actually does

Incorrect behavior order during transition between executive monitor and SMI transfer monitor (STM) allows a privileged local user to escalate privileges on affected Intel processors.

Why it matters to the business

Organizations running vulnerable systems face risk of unauthorized elevation to higher privileges by insiders or compromised accounts with existing high-level access, potentially leading to full system control and data exposure.

How an attack unfolds

An attacker with local high-privilege access triggers a specific sequence of monitor transitions that violates expected ordering, bypassing intended protections to gain elevated control; no widespread threat actors or ransomware campaigns are associated with this issue.

How to fix it

Apply vendor updates to affected products; for drush (Bitnami) upgrade to version 9.3.19 or later. Where processor microcode or firmware updates are available from Intel, deploy them according to manufacturer guidance.

How to confirm the fix worked

Confirm installed versions match or exceed the fixed releases, review processor microcode levels, and verify that no unpatched systems remain in the environment through asset inventory scans.

Typical attack path

1. Obtain local access with high privileges on a vulnerable system
2. Craft and execute a sequence of operations that exercises the executive monitor to STM transition
3. Exploit the incorrect ordering to escalate privileges
4. Perform post-exploitation actions such as installing persistence or accessing sensitive data

How to detect it

Review local authentication logs, process creation events, and any available SMI or monitor transition telemetry for anomalous sequences initiated by privileged users; no known public exploit artifacts exist at this time.

What your security team should do

• Prioritize patching systems with the provided fixed versions within standard change windows
• Audit local privileged accounts and reduce unnecessary high-privilege access
• Monitor for any future EPSS increases or KEV inclusion given the local privilege-escalation nature