CVE-2024-38106
Published: 13 August 2024
Summary
CVE-2024-38106 is a high-severity Sensitive Data Storage in Improperly Locked Memory (CWE-591) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.0 (High).
Operationally, ranked in the top 26.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-3 (Access Enforcement).
Deeper analysis
The vulnerability CVE-2024-38106 is a Windows Kernel Elevation of Privilege Vulnerability affecting the Windows kernel. It is assigned a CVSS 3.1 score of 7.0 under the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H and is associated with CWE-591.
An attacker with local access and low privileges can exploit the flaw, although the high attack complexity requirement limits the likelihood of success; successful exploitation would allow elevation of privileges with high impact to confidentiality, integrity, and availability.
Microsoft has published guidance for the issue, and the CVE is referenced in CISA's known exploited vulnerabilities catalog. The current EPSS score is 0.0075.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37137
Vulnerability details
Windows Kernel Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 13 August 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the August 2024 security updates that eliminate the kernel EoP flaw before local attackers can exploit it.
Enforces least-privilege restrictions on local accounts so that even a successful exploit of CVE-2024-38106 yields only the minimal rights originally granted rather than immediate SYSTEM access.
Requires the kernel to enforce access-control decisions that block unauthorized elevation from low-privileged local sessions to SYSTEM-level rights.