CVE-2024-38193highunder attackCWE-416

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

78Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 28%

from disclosure to weapon0 days

Published on NVDAug 13

1st PoCJul 9

CISA KEVAug 13

exploitation probability

28%top 2% of all CVEs

observed exploitation

yesCISA + VulnCheck

5 public exploit(s)

Action required by CISAfederal deadline: 2024-09-03

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Windows' network driver allows a logged-in user to gain higher system privileges (administrator access) without proper authorization. An attacker who already has a user account on the machine can exploit this to take full control of the system.

Technical detail

A use-after-free vulnerability (CWE-416) in the Windows Ancillary Function Driver for WinSock enables local privilege escalation. An authenticated attacker can trigger memory corruption through crafted WinSock function calls, leading to execution with SYSTEM privileges; requires local code execution capability and valid user credentials.

Summary generated and translated by AI from the official description.

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Affected products

public PoCs found — 5

cve_referencewww.exploit-db.com/exploits/52284unverified githubgithub.com/killvxk/CVE-2024-38193-Nephster★ 60 vulncheckvulncheck.com/xdb/0f2aa497e815unverified vulncheckvulncheck.com/xdb/fe97c3479e7funverified vulncheckvulncheck.com/xdb/083768bfaf83unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38193 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38193 https://www.exploit-db.com/exploits/52284