OnlyPatch
Windows Kernel

CVE-2024-21338 — Windows Kernel Elevation of Privilege Vulnerability

Important CVSS 7.8 EPSS 0.5981 ⚠️ Exploited in the wild 🔬 Patch diffed 2024-02 archive

Executive Summary

None

Overview

7.8
CVSS HIGH
Important
MS Severity
Exploited
MS Exploit Status
Exploitation Detected
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-822: Untrusted Pointer Dereference
Released Feb 13 2024
Last Updated Feb 13 2024
Publicly Disclosed No
CISA KEV Listed (added 2024-03-04)
Known Exploits None Known
EPSS Score 0.5981 — 0.99051 percentile
NVD CVSS 7.8 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Functional
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.2

EPSS Score

0.5981
probability of exploitation in the next 30 days
0.99051 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

20 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1809 for 32-bit Systems 5034768 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for ARM64-based Systems 5034768 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5034768 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5034763 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5034763 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5034763 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5034763 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5034763 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5034763 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for ARM64-based Systems 5034766 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 21H2 for x64-based Systems 5034766 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for ARM64-based Systems 5034765 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 22H2 for x64-based Systems 5034765 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5034765 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5034765 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5034768 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5034768 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5034770 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 (Server Core installation) 5034770 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5034769 (Security Update) Important Elevation of Privilege Yes

Patches

6 patches
Article Type Restart
5034768 Security Update Yes
5034763 Security Update Yes
5034766 Security Update Yes
5034765 Security Update Yes
5034770 Security Update Yes
5034769 Security Update Yes

Patch Diff

ghidriff · appid.sys (KB5034765)

Patch diff 10.0.22621.2506 -> 10.0.22621.3155 (ITW BYOVD/appid IOCTL fix; AipDeviceIoControlDispatch input validation)

Pre-patch version 10.0.22621.2506
Post-patch version 10.0.22621.3155
Function Address Change Note
__GSHandlerCheck 1c0005c88 -> 1c0005f78 refcount, address similarity 1.0
_guard_dispatch_icall 1c0005f50 -> 1c0006240 refcount, address, calling similarity 0.89
__security_check_cookie 1c00010c0 refcount, calling similarity 1.0
AipDeviceIoControlDispatch 1c001df20 code, length, called similarity 0.4
NTOSKRNL.EXE::RtlQueryFeatureConfiguration EXTERNAL:000000a7 -> EXTERNAL:000000a8 refcount, address, calling similarity 1.0
wil_details_FeatureReporting_ReportUsageToService 1c000217c -> 1c00015c0 refcount, address, calling similarity 1.0
View full diff report View RCA report Download PoC

Attack Path

BYOVD-style kernel code execution - appid.sys dereferences a function pointer supplied in the IOCTL input buffer

Attack path for CVE-2024-21338 BYOVD-style kernel code execution - appid.sys dereferences a function pointer supplied in the IOCTL input buffer 01 — ENTRY Attacker opens \Device\AppID as a standard user NtDeviceIoControlFile with IOCTL 0x22A018. appid.sys ships with AppLocker and is present by default, which is what made this attractive to Lazarus - no vulnerable third-party driver needed. 02 — CONTROLLED INPUT Supplies a 0x18-byte buffer whose +0x10 field is a function pointer +0x00 FirstArg (dereferenced once, becomes rcx), +0x08 FILE_OBJECT address used for refcounting, +0x10 pointer to a CFG_FUNCTION_WRAPPER. All three are attacker-chosen. 03 — PATH The dispatcher routes the IOCTL into the image-hashing helpers AipDeviceIoControlDispatch -> AipSmartHashImageFile -> AppHashComputeFileHashesInternal -> AppHashComputeImageHashInternal. 04 — MISSING CHECK AipDeviceIoControlDispatch performs no validation on the SystemBuffer contents AppHashComputeImageHashInternal executes call [*(SystemBuffer+0x10)] with rcx = *(SystemBuffer+0x00). The patch adds the missing input validation in the dispatch handler. 05 — PRIMITIVE Arbitrary kernel function call with a controlled first argument Direct kernel RIP control from an unprivileged caller. Used in the wild to disable EDR by writing through a kernel primitive rather than loading a signed vulnerable driver.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

8 public PoCs
RepositoryStarsPublishedDescription
hakaioffsec/CVE-2024-21338 335 2024-04-13 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled.
Crowdfense/CVE-2024-21338 80 2024-07-29 Windows AppLocker Driver (appid.sys) LPE
tykawaii98/CVE-2024-21338_PoC 40 2024-06-23
Zombie-Kaiser/CVE-2024-21338-x64-build- 7 2024-05-18 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled.
MistyFir/CVE-2024-21338-Exploit 7 2026-03-11
UMU618/CVE-2024-21338 2 2024-04-17 Fork of https://github.com/hakaioffsec/CVE-2024-21338
wusijie/CVE-2024-21338-1 2 2024-05-05 PoC for the Untrusted Pointer Dereference in the appid.sys driver
hackyboiz/kcfg-bypass 2 2025-01-12 kcfg bypass example - CVE-2024-21338

Detection Rules

Acknowledgments

Jan Vojtěšek with Avast

On This Page