CVE-2024-38106

What it actually does

CVE-2024-38106 is a local elevation-of-privilege vulnerability in the Windows Kernel affecting supported Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 releases. A user who already has local code execution with low privileges can exploit the kernel flaw to gain high-integrity or SYSTEM-level privileges, compromising confidentiality, integrity, and availability of the host. The CVSS vector indicates local access, low privileges, no user interaction, and high attack complexity, which is consistent with a kernel exploit that may require precise system state or timing but can fully compromise a machine once successful.

Why it matters to the business

Successful exploitation lets an attacker turn an initial foothold into full control of a Windows workstation or server. That can enable credential theft, security tool tampering, persistence, lateral movement, data theft, and deployment of additional malware. This vulnerability is listed in CISA KEV and has been observed exploited in the wild, with a CISA remediation due date of 2024-09-03 that has already passed, so unpatched systems should be treated as high-priority exposure even though it is not currently marked by CISA as ransomware-associated.

How an attack unfolds

An attacker first obtains a way to run code locally on a vulnerable Windows system, such as through phishing, malicious documents, stolen credentials, remote access tooling, or exploitation of a separate remote-code-execution vulnerability. From that low-privileged context, the attacker runs a purpose-built local exploit that interacts with vulnerable Windows kernel functionality. Because the flaw has high attack complexity, reliable exploitation may require arranging kernel memory or timing conditions, but a successful attempt results in elevated privileges such as SYSTEM. The attacker can then disable defenses, dump credentials, install persistence, move laterally, or execute their main objective. Public reporting confirms active in-the-wild exploitation, so defenders should assume working exploit chains exist even if the vulnerable kernel internals are not broadly documented.

How to fix it

Apply the Microsoft security update that fixes CVE-2024-38106 for all affected Windows versions. Because Windows updates are cumulative, installing the August 2024 Patch Tuesday security update or any later cumulative update for the relevant Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, or Windows Server 2022 release should remediate the issue. Prioritize internet-facing, multi-user, administrative, VDI, jump host, domain-joined, and high-value server systems. Where immediate patching is not possible, reduce local logon rights, remove unnecessary local administrator access, enforce application control, block untrusted executable content, harden EDR tamper protection, and monitor for privilege-escalation behavior. Mitigations do not replace patching because the vulnerable kernel component remains present until updated.

How to confirm the fix worked

Confirm that each affected Windows asset has installed the applicable August 2024 or later cumulative security update using enterprise patch management, Windows Update history, Microsoft Defender Vulnerability Management, WSUS/SCCM/Intune reporting, or PowerShell checks such as Get-HotFix and OS build inventory. Validate against Microsoft Security Update Guide entries for CVE-2024-38106 because the exact KB varies by Windows version and servicing channel. Confirm that superseding cumulative updates are installed, that reboots were completed, and that no devices remain on unsupported or unpatched builds such as older Windows 10, Windows 11, or Windows Server releases listed as affected. For exposure validation, inventory systems matching the affected product list and flag any that have not received August 2024 or later security updates.

Typical attack path

1. Gain initial access to a Windows endpoint or server through credentials, malware, social engineering, or another vulnerability.
2. Execute code as a low-privileged local user on an affected Windows version.
3. Run a local kernel privilege-escalation exploit targeting CVE-2024-38106.
4. Obtain elevated privileges, commonly high-integrity administrator or SYSTEM-level execution.
5. Use elevated access to tamper with security controls, access protected files, dump credentials, or create persistence.
6. Expand control through lateral movement or deploy follow-on payloads.

How to detect it

There are no universally reliable public indicators that uniquely identify exploitation of this kernel vulnerability. Detection should focus on behavioral evidence of local privilege escalation and post-exploitation activity. Review EDR telemetry, Sysmon logs, Windows Security logs, PowerShell logs, service-control events, scheduled task events, and authentication logs for a low-privileged process or user suddenly spawning elevated or SYSTEM-level processes. Hunt for unusual parent-child relationships where user-writable paths launch privileged processes, unexpected service creation, unexpected scheduled tasks, EDR or logging tampering, credential-dumping attempts, LSASS access, suspicious driver loading, and rapid privilege changes following initial malware execution. Correlate with patch state: any suspicious privilege escalation on a system missing August 2024 or later cumulative Windows updates should be prioritized. Since this CVE is in KEV and exploited in the wild, look back to at least the publication date, 2024-08-13, and extend the window based on available telemetry retention.

What your security team should do

• Treat unpatched affected Windows systems as urgent because the vulnerability is in CISA KEV and exploitation has been observed in the wild.
• Patch all affected Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 systems with the applicable August 2024 or later cumulative update.
• Prioritize systems used for administration, remote access, software deployment, identity services, developer workstations, VDI, and shared servers where local privilege escalation has outsized impact.
• Run an enterprise-wide query for affected OS versions and missing post-August-2024 cumulative updates, then track remediation to closure.
• Hunt for signs of local privilege escalation followed by credential dumping, EDR tampering, suspicious service creation, scheduled task creation, or unexpected SYSTEM-level child processes.
• Review local administrator group membership, remove unnecessary privileges, and enforce least privilege to reduce the value of this exploit.
• Ensure EDR, tamper protection, LSASS protection, credential guard where applicable, and centralized Windows event logging are enabled on high-value systems.
• Investigate any host where a low-privileged user context quickly transitions to SYSTEM execution without a known administrative tool or software deployment event.