Skip to content
OpenAdvisories
High MSRC-CVE-2024-38202 1 CVE

Windows Update Stack Elevation of Privilege Vulnerability

Published Aug 13, 2024 · Updated Oct 15, 2024 · Revision 4

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited, publicly disclosed before the fix — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
The attacker must have permissions to access the target's System directory to plant the malicious folder that would be used as part of the exploitation.

Are there additional steps that I need to take to be protected from this vulnerability?
Depending on the version of Windows you are running, you might need to take additional steps to update Windows Recovery Environment (WinRE) to be protected from this vulnerability.
For the latest version of Windows the process of updating WinRE is now fully automated. The following versions of Windows require no additional steps as WinRE will be updated as a part of the Latest Cumulative Update if you are getting updates from Windows Update and WSUS:
Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 22H2 for x64-based Systems, Windows 11 Version 22H2 for ARM64-based Systems
For the following versions of Windows, the WinRE updates listed are available. These updates automatically apply the latest Safe OS Dynamic Update to WinRE from the running Windows OS:
Windows Server 2022 (Server Core installation) (KB5046399: Windows Recovery Environment update for Azure Stack HCI, version 22H2 and Windows Server 2022: October 8, 2024), Windows Server 2022 (KB5046399: Windows Recovery Environment update for Azure Stack HCI, version 22H2 and Windows Server 2022: October 8, 2024), Windows Server 2022, 23H2 Edition (Server Core installation) (KB5046399: Windows Recovery Environment update for Azure Stack HCI, version 22H2 and Windows Server 2022: October 8, 2024), Windows 11 version 21H2 for x64-based Systems (KB5046398: Windows Recovery Environment update for Windows 11, version 21H2: October 8, 2024), Windows 10 Version 22H2 for x64-based Systems (KB5046400: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: October 8, 2024), Windows 10 Version 22H2 for 32-bit Systems (KB5046400: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: October 8, 2024), Windows 10 Version 21H2 for x64-based Systems (KB5046400: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: October 8, 2024), Windows 10 Version 21H2 for 32-bit Systems (KB5046400: Windows Recovery Environment update for Windows 10, version 21H2 and 22H2: October 8, 2024)
As an alternative to updates provided in the preceding list or if your version of Windows is not listed, you can download the latest Windows Safe OS Dynamic Update from the Microsoft Update Catalog then apply the WinRE update. For more information reference Add an update package to Windows RE. To automate your installation, Microsoft has developed a sample script that can help with updating WinRE from the running Windows OS. Please see KB5034957: Updating the WinRE partition on deployed devices to address security vulnerabilities in CVE-2024-20666 for more information.
Use DISM /Get-Packages on a mounted WinRE image to ensure the latest Safe OS Dynamic Update package is present. For more information, see Check the WinRE image version.

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

According to the CVSS metric, user interaction is required (UI:R). What does that mean for this vulnerability?
To successfully exploit this vulnerability, an attacker must convince or trick an administrative user into performing a system restore.

Security updates
10.0.17763.6414 — https://support.microsoft.com/help/5044277
10.0.20348.2762 — https://support.microsoft.com/help/5044281
10.0.22000.3260 — https://support.microsoft.com/help/5044280
10.0.19044.5011 — https://support.microsoft.com/help/5044273
10.0.22621.4317 — https://support.microsoft.com/help/5044285
10.0.25398.1189 — https://support.microsoft.com/help/5044288
10.0.14393.7428 — https://support.microsoft.com/help/5044293

Vulnerabilities 1

Revision history

  1. #4

    Executive Summary revised to correct the availability status of security updates which mitigate this vulnerability as they were released October 08, 2024 and are provided in the Security Updates table of this CVE. This is an informational change only.

  2. #3

    To address this elevation of privilege vulnerability Microsoft has released October 2024 security updates for all affected versions of Windows. Microsoft recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action. In addition, depending on the version of Windows you are running, you might need to take additional steps to update Windows Recovery Environment (WinRE) to be protected from this vulnerability. Please refer to the FAQ section for more information.

  3. #2

    Added an additional recommended action option and edited the details of a separate recommended action in the CVE Executive Summary.

  4. #1

    Information published.

References