CVE-2024-38193
Published: 13 August 2024
Summary
CVE-2024-38193 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2024-38193 is a use-after-free vulnerability (CWE-416) in the Windows Ancillary Function Driver for WinSock that permits local elevation of privilege. The flaw affects supported Windows systems and carries a CVSS 3.1 score of 7.8, reflecting local attack vector, low complexity, and low required privileges with high impact on confidentiality, integrity, and availability.
An authenticated local attacker can trigger the flaw to escalate privileges and obtain full control over the affected system. Public exploit code is available, and the vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
Microsoft’s security update guide provides official remediation details and patch availability, while CISA guidance emphasizes prompt application of vendor fixes for affected Windows installations.
The EPSS score reached a peak of 0.7519 and remains elevated at 0.7323, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37161
Vulnerability details
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 13 August 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of security-relevant patches that eliminate the use-after-free flaw in the Ancillary Function Driver.
Enforces least-privilege execution so that a low-privileged local account cannot reach the vulnerable kernel driver path.
Implements memory-protection mechanisms that can block or complicate exploitation of use-after-free conditions in kernel drivers.