CVE-2024-38193

What it actually does

CVE-2024-38193 is a local elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock, commonly associated with afd.sys. An attacker who already has the ability to run code as a low-privileged user can exploit the kernel-mode driver to elevate privileges, typically to NT AUTHORITY\SYSTEM. Because the affected component is part of Windows networking support and runs in kernel context, successful exploitation can provide full confidentiality, integrity, and availability impact on the local host.

Why it matters to the business

Successful exploitation can turn an initial low-privilege foothold into full control of a Windows workstation or server, enabling credential theft, endpoint security tampering, lateral movement, data theft, and deployment of additional malware. This vulnerability is listed in CISA KEV and has active exploitation reported in the wild, with a CISA remediation deadline of 2024-09-03, so unpatched systems should be treated as high-priority exposure even though exploitation requires prior local access.

How an attack unfolds

An attacker first gains a low-privileged foothold on a Windows system through another method, such as stolen credentials, phishing, malware execution, exploitation of an exposed service, or web shell access. From that foothold, the attacker executes a local exploit that interacts with the Windows Ancillary Function Driver for WinSock. By abusing the flaw in the kernel driver, the exploit manipulates privileged kernel behavior and elevates the attacker-controlled process or token to SYSTEM-level privileges. The attacker can then disable security tooling, dump credentials, create services or scheduled tasks for persistence, access sensitive files, move laterally using harvested credentials, or stage ransomware or other payloads. Because this CVE has been observed in active exploitation, defenders should assume public or private exploit tooling may exist and should look for post-exploitation behavior rather than relying only on crash or exploit-specific signatures.

How to fix it

Apply the Microsoft security updates released for affected Windows versions, including Windows 10, Windows 11, and Windows Server releases listed as affected. Because no per-product fixed build numbers were provided in the input, use the August 2024 Patch Tuesday cumulative update or any later cumulative/security update applicable to each Windows version. Prioritize internet-facing servers, domain-joined workstations used by administrators, jump hosts, VDI images, and servers where low-privileged users or application service accounts can execute code. If immediate patching is not possible, reduce risk by restricting local logon and code execution, limiting RDP and remote management access, enforcing least privilege, blocking untrusted binaries through application control, enabling tamper protection, and monitoring for local privilege-escalation and post-exploitation behavior. Mitigations should not be considered a substitute for patching because the vulnerable kernel driver is a core Windows component.

How to confirm the fix worked

Confirm that each affected system has installed the applicable August 2024 or later Microsoft cumulative/security update. Validate through Windows Update history, Microsoft Update Compliance, enterprise patch management inventory, or by checking OS build and installed KBs against Microsoft’s security update guidance for CVE-2024-38193. Where feasible, verify that C:\Windows\System32\drivers\afd.sys has a post-fix file version and timestamp consistent with the installed Microsoft update. Reboot systems after patching when required, because kernel driver updates are not fully effective until the updated driver is loaded. Confirm no unsupported Windows versions remain exposed, and test representative endpoints and servers to ensure networking functionality and security tooling remain operational after patch deployment.

Typical attack path

1. Obtain initial access to a Windows endpoint or server as a standard or otherwise low-privileged user.
2. Transfer or stage a local privilege-escalation exploit targeting the Windows Ancillary Function Driver for WinSock.
3. Run the exploit locally; no user interaction is required once the attacker can execute code.
4. Gain SYSTEM-level privileges or spawn a privileged process.
5. Perform post-exploitation actions such as credential dumping, EDR tampering, service creation, scheduled task creation, persistence, or lateral movement.
6. Use the compromised host to access sensitive data, expand through the environment, or deploy additional malware.

How to detect it

There is no single reliable built-in Windows log entry that proves exploitation of this kernel vulnerability, so detection should focus on exposure plus post-exploitation behavior. Review patch status and afd.sys versions to identify systems that were vulnerable during the active exploitation window. Hunt across Windows Security logs, Sysmon, EDR telemetry, Windows Defender logs, service-control logs, scheduled task logs, PowerShell logs, and crash/WER data. Look for a low-privileged user process suddenly creating or spawning a SYSTEM-level process, especially cmd.exe, powershell.exe, pwsh.exe, rundll32.exe, regsvr32.exe, mshta.exe, wscript.exe, cscript.exe, or unknown binaries from user-writable directories. Review Security events 4672, 4688, 4697, 4698, 4624, and 4648; System event 7045; Sysmon events 1, 7, 10, 11, 12, 13, and 22; and EDR alerts for kernel exploit, token theft, privilege escalation, or suspicious AFD device interaction. Investigate crashes or bugchecks referencing afd.sys around suspicious logon sessions, as failed exploit attempts may destabilize the driver or host. Post-exploitation indicators include new services, new scheduled tasks, LSASS access, credential dumping tools, security tool disablement, suspicious outbound connections after privilege elevation, and lateral movement from the affected endpoint. Where advanced telemetry is available, inspect ETW or EDR device I/O events for unusual access to \\.\Afd or \Device\Afd from non-networking or recently dropped user-mode binaries.

• C:\Windows\System32\drivers\afd.sys
• afd.sys
• \\.\Afd
• \Device\Afd
• EventCode=4672
• EventCode=4688
• EventCode=4697
• EventCode=4698
• EventCode=7045
• NT AUTHORITY\SYSTEM
• SeDebugPrivilege
• SeImpersonatePrivilege
• lsass.exe
• comsvcs.dll, MiniDump
• rundll32.exe C:\Windows\System32\comsvcs.dll
• schtasks.exe /create
• sc.exe create
• powershell.exe -ExecutionPolicy Bypass
• powershell.exe -EncodedCommand
• cmd.exe /c whoami /all
• BugCheck
• Microsoft-Windows-WER-SystemErrorReporting

What your security team should do

• Treat this as urgent because it is in CISA KEV and has active exploitation reported in the wild; prioritize remediation for all supported Windows workstations and servers.
• Patch affected Windows 10, Windows 11, and Windows Server systems with the August 2024 or later cumulative/security update, then reboot to ensure the updated kernel driver is loaded.
• Use asset inventory to identify unsupported or unpatched Windows versions and isolate, upgrade, or retire systems that cannot receive the fix.
• Hunt for recent privilege-escalation chains: low-privileged processes spawning SYSTEM shells, unexpected service creation, scheduled tasks, credential-dumping activity, EDR tampering, and suspicious child processes from user-writable paths.
• Increase monitoring for post-exploitation activity on systems that were unpatched after publication or past the 2024-09-03 KEV deadline.
• Restrict local administrator rights and interactive logon paths, especially on servers and administrator workstations, to reduce the value of local privilege escalation.
• Enable or tune Sysmon/EDR telemetry for process creation, driver/module load events, LSASS access, service creation, scheduled task creation, and suspicious token or privilege changes.
• If exploitation is suspected, preserve volatile evidence, collect memory or triage artifacts, rotate credentials that may have been exposed, and investigate lateral movement from the affected host.