Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-30051

7.8HIGH

Key Information:

Vendor
Microsoft
Status
Windows 10 Version 1809
Windows Server 2019
Windows Server 2019 (server Core Installation)
Windows Server 2022
Vendor
CVE Published:
14 May 2024

Badges

📈 Trended📈 Score: 11,600💰 Ransomware👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2024-30051?

CVE-2024-30051 is a significant vulnerability found in the Windows Desktop Window Manager (DWM) Core Library, which plays a crucial role in rendering graphics and managing visual effects in Windows operating systems. This vulnerability allows for elevation of privilege, meaning that an attacker can exploit it to gain higher access rights than intended. If successfully leveraged, it could lead to unauthorized control over the system, allowing the attacker to execute arbitrary code with elevated permissions. This poses a substantial risk to organizations reliant on Windows environments, as it may compromise sensitive data, disrupt operations, or facilitate further malicious activities within the network.

Technical Details

CVE-2024-30051 specifically targets the DWM Core Library, enabling attackers to exploit weaknesses in how privilege levels are managed. By manipulating the library's functions, they can escalate their access, thus breaching security models designed to separate user privileges from administrative capabilities. The technical intricacies stem from flaws in the library's handling of specific requests, bypassing existing safeguards that protect against unauthorized access and execution within the operating system. The vulnerability impacts multiple versions of Windows, making it a widespread risk across various user environments.

Impact of the Vulnerability

  1. Unauthorized System Control: The most immediate impact of CVE-2024-30051 is the potential for attackers to gain unauthorized control over affected systems. After successful exploitation, an attacker can execute arbitrary commands, manipulate system settings, or install malicious software.

  2. Data Exfiltration and Breaches: With elevated privileges, attackers can access sensitive files and databases, leading to significant data breaches. This not only endangers organizational assets but can also violate regulatory compliance standards, resulting in legal consequences.

  3. Increased Malware Deployment: The exploitation of this vulnerability provides a foothold for attackers to deploy additional malware, such as ransomware or remote access tools, creating further disruption and risk to the organization. This can lead to extended downtime, costly recovery efforts, and potential loss of customer trust.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Windows 10 Version 1507 32-bit Systems 10.0.10240.0 < 10.0.10240.20651

Windows 10 Version 1607 32-bit Systems 10.0.14393.0 < 10.0.14393.6981

Windows 10 Version 1809 32-bit Systems 10.0.17763.0 < 10.0.17763.5820

News Articles

favicon image@Securelist

Malware report for Q2 2024 — a quarterly review

In this report, Kaspersky researchers explore the most significant attacks of Q2 2024 that used a XZ backdoor, the LockBit builder, ShrinkLocker ransomware, etc.

4 months ago

favicon imageTelconet CSIRT

Microsoft corrige múltiples vulnerabilidades en su Patch Tuesday de mayo 2024 – Telconet CSIRT

Microsoft realiza actualizaciones de seguridad con su Patch Tuesday de mayo del 2024 en el que se aborda un total de 61 fallos de seguridad, que incluyen tres vulnerabilidades Zero Day. En esta edición, se...

5 months ago

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📈

    Vulnerability started trending

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by SecurityWeek

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre DatabaseCISA DatabaseMicrosoft Feed12 News Article(s)
.