# CVE-2024-38107 — Windows Power Dependency Coordinator `pdc.sys` Unsynchronized ALPC Message Processing → Use-After-Free (Exploited in the Wild)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `pdc.sys` (Power Dependency Coordinator) |
| **CVE ID** | CVE-2024-38107 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 7.2 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` |
| **CWE** | CWE-416: Use After Free |
| **Delivery** | Local — concurrent ALPC messages to the PDC |
| **KB / Fixed build** | KB5041571 — `pdc.sys` 10.0.26100.1455 (Win11 24H2 x64) |
| **Patch Date** | August 13, 2024 (2024-Aug) |
| **Pre-patch binary** | `pdc.sys` 10.0.26100.1301 — SHA256 `5b22e887722d6f59f787354d6bca1cd8f91b1ad469be26d1de126729cd47588a` |
| **Post-patch binary** | `pdc.sys` 10.0.26100.1455 — SHA256 `11ee9f3cbec684cfcae87497a67878e0f83d5b7a6e5c9417aefed7baf7af60a6` |
| **Feature flag** | `Feature_760025401` — **the fix is CFR-gated** |
| **Exploitability** | **Exploitation Detected** (exploited in the wild); not publicly disclosed (per MSRC) |

> Sourcing note: OS fixed build `.1457`; the `pdc.sys` binary in KB5041571 is `.1455`.
> Pre = `.1301`.

---

## Product Description

`pdc.sys` is the Windows **Power Dependency Coordinator**, a kernel driver that
services client requests over ALPC. `PdcpAlpcProcessMessages` → `PdcProcessMessage`
handle inbound client messages and manage per-client objects, which are torn down
via `PdcFreeClient`.

---

## Vulnerability Summary

Pre-patch, PDC message processing and client-object teardown were **not
serialized**. One ALPC message could free a PDC client object (`PdcFreeClient`) while
another concurrent message handler still referenced it — a use-after-free of the
client object (CWE-416). Because `pdc.sys` runs in the kernel and the ALPC interface
is reachable by a local user, the freed-object reuse is a local
elevation-of-privilege primitive to SYSTEM. MSRC marks this **Exploitation
Detected** — it was exploited in the wild.

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): send ALPC messages to the PDC.
- Issue concurrent messages that create and free the same client object.
- Result: a freed PDC client object is used by a concurrent handler.

---

## Vulnerability Details

### Root Cause

PDC ALPC message handlers shared per-client objects without a lock, so client
teardown in one handler could free an object another handler was still using.

### The patch (confirmed — diff, .1301 → .1455)

Gated behind `Feature_760025401`, `PdcProcessMessage` and `PdcpAlpcProcessMessages`
now take a **global PDC lock** around message processing and client freeing
(`PdcAcquireLock` / `PdcReleaseLock`), using `GetPdcLockThread` to detect the
already-owning thread and avoid a recursive re-acquire:

```c
// PdcpAlpcProcessMessages (10.0.26100.1455) — PATCHED (from our diff)
if (Feature_760025401__private_IsEnabledDeviceUsage()) {
    if (GetPdcLockThread() != current_thread)     // reentrancy-aware
        PdcAcquireLock();
}
... PdcProcessMessage(...) ...   // dispatch under the lock
if (Feature_760025401__private_IsEnabledDeviceUsage())
    PdcReleaseLock();

// PdcProcessMessage — PdcAcquireLock() held around the handling / PdcFreeClient(...) calls
```

Serializing message processing and client teardown under the global lock ensures a
PDC client object cannot be freed while another handler is using it, closing the
use-after-free.

### Patch Completeness Assessment

**CFR-gated behind `Feature_760025401`.** The lock-serialized processing runs only
when the flag is enabled; the original unsynchronized path still ships when disabled.
Verify `Feature_760025401` is enabled to confirm the fix is live. (Given in-the-wild
exploitation, apply KB5041571 or later regardless.)

---

## Detection Guidance

**Behavioural.** High-rate / concurrent ALPC traffic to the Power Dependency
Coordinator; use-after-free / pool-corruption bugchecks in `pdc!PdcProcessMessage` /
`PdcpAlpcProcessMessages` / `PdcFreeClient` on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_760025401` is enabled.

---

## References

- MSRC advisory — CVE-2024-38107 (Windows Power Dependency Coordinator Elevation of Privilege), released 2024-08-13, KB5041571. Exploitation Detected.
- Full binary diff: `/data/patch_diffs/pdc_sys-cve-2024-38107-ghidriff.md`