CVE-2024-10630
Published: 14 January 2025
Summary
CVE-2024-10630 is a high-severity Race Condition within a Thread (CWE-366) vulnerability in Ivanti Application Control. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-10630 is a race condition vulnerability, classified under CWE-366, affecting Ivanti Application Control Engine in versions prior to 10.14.4.0. This flaw enables a local authenticated attacker to bypass the application's blocking functionality, undermining endpoint security controls designed to restrict unauthorized software execution. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high potential impacts on confidentiality, integrity, and availability within the local scope.
A low-privileged local authenticated user can exploit this race condition by timing operations to evade blocking mechanisms, allowing execution of restricted or malicious applications. Successful exploitation grants the attacker high-level access to system resources, potentially leading to unauthorized data access, modification, or disruption without requiring user interaction.
Ivanti has issued a security advisory detailing the vulnerability at https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Application-Control-Engine-CVE-2024-10630, which recommends upgrading to version 10.14.4.0 or later to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33589
Vulnerability details
A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Race condition in local application control engine directly enables low-priv authenticated user to bypass execution restrictions, matching Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the race condition in Ivanti Application Control Engine by requiring installation of the vendor patch to version 10.14.4.0 or later.
Mandates a tamper-proof reference monitor that reliably enforces application access control policies, preventing race condition-based bypasses of blocking functionality.
Enforces organization-defined restrictions on software usage and execution, providing layered policy enforcement to mitigate bypasses in flawed application control mechanisms.