Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Successful exploitation allows an attacker with local administrative control to defeat part of the security value of a fully patched Windows installation by restoring outdated vulnerable binaries. This can re-enable previously mitigated vulnerabilities, weaken or bypass VBS protections, and expose secrets or data protected by VBS. Depending on the downgraded component and follow-on exploit path, this can facilitate further privilege escalation within VBS-protected contexts, compromise of protected security features such as Credential Guard-related protections, and access to sensitive material that would otherwise remain isolated from a compromised normal kernel environment.

If immediate full remediation is not yet deployed, implement Microsoft’s published rollback-blocking mitigations from KB5042562. The primary mitigations described in the content are: a Microsoft-signed CI policy enabled by default at boot that prevents rollback of VBS system files for that boot session, and an optional administrator-deployed revocation policy, SkuSiPolicy.p7b, that blocks vulnerable VBS-related binaries from loading across boot sessions. Before deploying SkuSiPolicy.p7b, validate operational readiness because Microsoft warns of significant risks, including boot failures, boot loops, rollback limitations, and the need to update WinRE, external boot media, and PXE boot images to compatible versions. On Windows 11 24H2, Windows Server 2022, and Windows Server 23H2, additional DRTM-based protections are enabled by default and should be retained.

Apply Microsoft’s mitigations and servicing guidance for CVE-2024-21302, specifically KB5042562, and ensure systems are updated to supported Windows releases that include Microsoft’s protections. Microsoft states it introduced mitigations including a default-enabled Microsoft-signed Code Integrity policy loaded at boot, and also provided the optional revocation policy SkuSiPolicy.p7b to block vulnerable VBS-related binaries from loading. Follow Microsoft’s deployment guidance carefully, because the mitigation policy and Windows components must come from the same release level. Microsoft later completed mitigations across supported Windows 10 and Windows 11 versions, including Windows 10 1507, 1607, 1809, Windows Server 2016, and later supported platforms. Where applicable, also apply related guidance referenced by Microsoft, including KB5025885 and required Safe OS / WinRE / PXE image updates before enforcing the UEFI-bound revocation policy.