CVE-2024-21338

Name of the Vulnerable Software and Affected Versions Windows 10 (affected versions not specified) Windows 11 (affected versions not specified)

Description An elevation of privilege issue exists in the Windows kernel, specifically within the AppLocker driver appid.sys. The flaw stems from an exposed IOCTL (Input/Output Control) with insufficient access control, which allows an attacker with Administrator privileges to cross the boundary into the kernel. By abusing an untrusted pointer exposed through a kernel IOCTL, an attacker can call a user-controlled function pointer in kernel mode. Specifically, the exploit can use ExpProfileDelete() as a target to decrement PreviousMode from 1 to 0, causing NtWriteVirtualMemory() and NtReadVirtualMemory() to bypass security checks. This enables the manipulation of process tokens to obtain full SYSTEM privileges, even on systems with HVCI (Hypervisor-Protected Code Integrity) enabled. This issue has been exploited in the wild as a zero-day by the Lazarus group and has been utilized by the Mallox ransomware family and the BlackCat/ALPHV group.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.