PatchaPalooza

CVE-2024-37979: Windows Kernel Elevation of Privilege Vulnerability

CVE-2024-37979 is an elevation of privilege vulnerability in Windows Kernel, rated Important by Microsoft, with a CVSS 3.1 base score of 6.7 (Medium). An attacker can exploit it by an attacker with local access, with high privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.58% probability of exploitation activity in the next 30 days, higher than 48% of all scored vulnerabilities. Microsoft released the fix on 7 October 2024 in the October 2024 Patch Tuesday, delivered through 5 security updates (KB5044277, KB5044281, KB5044293, KB5044342 and more). It affects 10 products in 2 product families (Windows, ESU).

Key facts

CVE ID
CVE-2024-37979
Severity
Medium CVSS 6.7
Microsoft severity
Important
Impact
Elevation of Privilege
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-822
EPSS
0.58% (percentile 48%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
October 2024 Patch Tuesday
Product families
Windows, ESU

CVSS score and vector

Microsoft scores CVE-2024-37979 at 6.7 (temporal 5.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorLocal
Attack complexityLow
Privileges requiredHigh
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Frequently asked questions (Microsoft)

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Affected products (10)

Windows

ProductSecurity updateTypeFixed buildRestart
Windows Server 2019KB5044277Security Update10.0.17763.6414Yes
Windows Server 2019 (Server Core installation)KB5044277Security Update10.0.17763.6414Yes
Windows Server 2022KB5044281Security Update10.0.20348.2762Yes
Windows Server 2022 (Server Core installation)KB5044281Security Update10.0.20348.2762Yes
Windows Server 2016KB5044293Security Update10.0.14393.7428Yes
Windows Server 2016 (Server Core installation)KB5044293Security Update10.0.14393.7428Yes

ESU

ProductSecurity updateTypeFixed buildRestart
Windows Server 2012KB5044342Monthly Rollup6.2.9200.25118Yes
Windows Server 2012 (Server Core installation)KB5044342Monthly Rollup6.2.9200.25118Yes
Windows Server 2012 R2KB5044343Monthly Rollup6.3.9600.22221Yes
Windows Server 2012 R2 (Server Core installation)KB5044343Monthly Rollup6.3.9600.22221Yes

Security updates (5)

NIST NVD data

NVD status
Analyzed
NVD CVSS
6.7 (MEDIUM)
NVD weakness
CWE-822
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
windows server 2012all listed versions
windows server 2012 r2all listed versions
windows server 2016before 10.0.14393.7428
windows server 2019before 10.0.17763.6414
windows server 2022before 10.0.20348.2762

References

Acknowledgments

  • Netanel Ben Simon with Microsoft Offensive Research & Security Engineering

Revision history

VersionDateDescription
1.0Information published.

Sources