CVE-2024-35250

What it actually does

CVE-2024-35250 is a local elevation-of-privilege vulnerability in Windows kernel-mode driver functionality. A user-mode attacker who already has low-privileged code execution can trigger memory corruption, reported as an untrusted pointer dereference condition, in kernel context. Successful exploitation can allow the attacker to execute code with NT AUTHORITY\SYSTEM privileges, giving full control over the affected Windows host, including access to protected files, credentials, security tooling, and system configuration.

Why it matters to the business

This vulnerability turns an initial limited compromise into full host compromise. Because it is in CISA KEV, has active in-the-wild exploitation, and affects many supported Windows desktop and server versions, unpatched systems are high-priority targets for post-compromise privilege escalation. Business consequences can include endpoint takeover, ransomware staging, credential theft, lateral movement, disabling of security controls, and disruption of critical Windows server workloads. CISA’s KEV remediation deadline was 2025-01-06, so remaining exposure should be treated as overdue.

How an attack unfolds

An attacker cannot exploit this directly over the network without first obtaining local code execution or valid low-privileged access. In a typical intrusion, the attacker gains an initial foothold through phishing, stolen credentials, malware, an exposed remote access service, or exploitation of another application. They then run exploit code on the Windows host to interact with the vulnerable kernel-mode driver path and trigger the memory corruption condition. If successful, the exploit manipulates kernel memory or process security state so that the attacker-controlled process obtains SYSTEM-level privileges. The attacker can then spawn an elevated shell or service, dump credentials, tamper with endpoint defenses, create persistence, access sensitive data, and move laterally. Public reporting and KEV status indicate real-world exploitation, so defenders should assume this is useful in post-exploitation chains rather than a theoretical issue.

How to fix it

Apply the Microsoft security updates that address CVE-2024-35250 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2008, 2012, 2016, 2019, 2022, and Windows Server 2022 23H2 where applicable. In practical terms, systems should be updated to the June 2024 cumulative security update level or later, or to the latest available cumulative update for their supported servicing channel. Retire or isolate unsupported Windows versions that cannot receive security updates. If immediate patching is not possible, reduce risk by limiting interactive logon and RDP access, enforcing least privilege, blocking untrusted executable content, increasing endpoint monitoring, and isolating high-value servers until patched. There is no complete configuration-only mitigation that should be considered equivalent to applying the Microsoft fix.

How to confirm the fix worked

Confirm that each affected Windows host has installed the relevant Microsoft cumulative security update from June 2024 or later, or a later superseding update. Validate using Windows Update history, enterprise patch management inventory, `winver`, `systeminfo`, PowerShell hotfix inventory such as `Get-HotFix`, and Microsoft’s official security update guidance for the operating system build. Confirm that unsupported or out-of-servicing builds are either upgraded, enrolled in the appropriate extended update program where applicable, or removed from exposure. For security validation, attempt authenticated vulnerability scanning against Windows build and patch levels rather than relying only on banner data. A patched system should no longer be reported as vulnerable by reputable vulnerability scanners or Microsoft update compliance tooling.

Typical attack path

1. Gain initial access to a Windows workstation or server using phishing, malware, stolen credentials, exposed remote access, or another vulnerability.
2. Obtain the ability to run code as a standard or otherwise low-privileged local user.
3. Transfer or compile exploit tooling targeting the vulnerable Windows kernel-mode driver behavior.
4. Execute the exploit locally to trigger the memory corruption/untrusted pointer dereference condition in kernel context.
5. Elevate the attacker-controlled process or spawned process to NT AUTHORITY\SYSTEM.
6. Use SYSTEM privileges to disable defenses, dump credentials, create persistence, access sensitive files, or pivot to additional systems.
7. Clean up exploit artifacts, temporary files, event logs, or tooling where possible.

How to detect it

Detection should focus on post-exploitation behavior because exploitation is local and may not leave a single reliable application log entry. Collect and review Windows Security logs, Sysmon, EDR telemetry, PowerShell logs, service creation events, scheduled task events, crash dumps, and Windows Error Reporting artifacts. Look for a standard-user process that rapidly becomes or spawns a SYSTEM-level process, especially command shells, PowerShell, rundll32, regsvr32, msiexec, task scheduler, service-control utilities, credential-dumping tools, or security-tool tampering. Useful Windows events include Security 4688 for process creation, 4672 for special privileges assigned, 4624 for logons, 7045 in the System log for service creation, and PowerShell 4104 for script block logging. Also review EDR file and command-line telemetry for exploit filenames or references to CVE-2024-35250, kernel-mode driver exploitation, token manipulation, or public proof-of-concept tooling. Kernel exploitation may cause crashes or bugchecks during failed attempts, so correlate unexpected local privilege escalation behavior with recent system crashes, Windows Error Reporting entries, and suspicious files written to temporary or user-writable directories. Because this vulnerability is known to be exploited in the wild, any suspected exploitation should trigger full endpoint triage, credential exposure assessment, and lateral-movement review.

• CVE-2024-35250
• ks.sys
• NT AUTHORITY\SYSTEM
• Event ID 4688
• Event ID 4672
• Event ID 7045
• whoami /priv
• whoami /all
• cmd.exe /c whoami
• powershell.exe -nop
• sc.exe create
• schtasks.exe /create
• reg add HKLM\SYSTEM\CurrentControlSet\Services
• SeDebugPrivilege
• SeImpersonatePrivilege

What your security team should do

• Prioritize patching all internet-facing, remote-accessible, shared, administrative, and high-value Windows servers and workstations immediately; KEV status and active exploitation make this an overdue remediation item.
• Use endpoint detection and response telemetry to hunt for low-privileged processes that unexpectedly spawn SYSTEM shells, services, scheduled tasks, credential dumping tools, or security-control tampering shortly after user logon.
• Review patch compliance for all affected Windows 10, Windows 11, and Windows Server versions; require June 2024 or later cumulative updates, preferably the latest cumulative update.
• Restrict local administrator rights, interactive server logons, RDP access, and the ability of standard users to run unapproved binaries.
• Investigate any host with suspicious privilege escalation, credential dumping, endpoint protection tampering, or abnormal SYSTEM process creation as potentially compromised, not merely vulnerable.
• For hosts that cannot be patched quickly, isolate them from general user access and sensitive network segments until remediation is complete.
• Correlate exploitation hunting with initial-access events such as phishing payload execution, remote access logons, malware detections, suspicious script execution, and newly created services.