Loading vulnerability…
Windows Kernel Race Condition Privilege Escalation
CVE-2024-38106 is a Windows kernel elevation-of-privilege vulnerability involving sensitive data stored in improperly locked memory. A local attacker who wins a race condition can gain elevated privileges. The vulnerability has been actively exploited, including in a Citrine Sleet attack chain that combined Chromium remote code execution through CVE-2024-7971 with this kernel vulnerability to escape the browser sandbox and deploy the FudModule rootkit. Microsoft released a fix on August 13, 2024.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits local privilege escalation and can defeat browser sandbox isolation. Observed exploitation enabled deployment of the FudModule rootkit, supporting kernel tampering and defense evasion. The vulnerability is not a standalone remote code execution flaw; remote compromise in the observed browser attack chain depended on a separate Chromium vulnerability.
If you can’t patch tonight, do this now.
No CVE-specific workaround is identified. As defense in depth, keep Chromium-based browsers updated to disrupt the observed initial-access chain and deploy current endpoint protections capable of detecting related exploitation and FudModule activity. These measures do not replace the Windows security update.
Patch, then assume compromise.
Install the applicable Windows security updates released on August 13, 2024, or subsequent cumulative updates containing the fix. Prioritize affected systems because exploitation has been confirmed in the wild.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.