CVE-2024-38193: Microsoft Patches High-Severity Zero-Day Exploit Used by North Korea’s Lazarus Group

CVE-2024-38193 is a Windows flaw in the Ancillary Function Driver for WinSock that lets a local attacker gain higher privileges. Microsoft fixed it in its August 2024 Patch Tuesday update. The National Vulnerability Database lists a CVSS score of 7.8, rated High, and CISA added it to its Known Exploited Vulnerabilities catalog on August 13, 2024.

What is CVE-2024-38193?

A new vulnerability discovered in the Microsoft Windows operating system has been exploited as a zero-day attack by the Lazarus Group, a state-sponsored actor affiliated with North Korea. This vulnerability tracked as CVE-2024-38193, is identified as an elevation of a privilege bug in the Windows Ancillary Function Driver (AFD.sys) file for WinSock. The vulnerability was fixed as part of Microsoft’s monthly Patch Tuesday update and has been assigned a CVSS score of 7.8.

CVE-2024-38193 is an elevation of privilege flaw that allows attackers to bypass normal security restrictions and gain access to sensitive system areas that are inaccessible to most users and administrators. This vulnerability was exploited in attacks aimed at evading the detection of a rootkit called FudModule, which was used by the Lazarus Group.

How does it relate to CVE-2024-21338?

While the technical details of this vulnerability are not fully known at this time, it is similar to another elevation of privilege vulnerability (CVE-2024-21338) that Microsoft patched in February 2024. CVE-2024-21338 is a Windows kernel elevation flaw in the AppLocker driver (appid.sys) that allows arbitrary code execution, bypassing all security checks and executing the FudModule rootkit.

These attacks go beyond the “Bring Your Own Vulnerable Driver” (BYOVD) strategy and involve exploiting a vulnerability in a driver that is already installed on the Windows host to circumvent security measures.

Why should Windows users patch?

These attacks demonstrate the sophistication of the Lazarus Group in exploiting vulnerabilities in existing systems. The use of the FudModule rootkit only in special cases reveals the attackers’ careful strategy to evade security systems and avoid detection. The CVE-2024-38193 vulnerability poses a serious threat to all Windows users, and it is therefore critical that Microsoft’s patches are applied in a timely manner.

Who found CVE-2024-38193 and when was it fixed?

Researchers Luigino Camastra and Milanek of Gen Digital (the company behind Avast and Norton) found the flaw in early June 2024 while investigating Lazarus activity, and reported it to Microsoft. Their write-up says the group used it to reach sensitive system areas and to hide its activity from security software, with targets in the cryptocurrency and aerospace sectors. Microsoft shipped the fix on 13 August 2024, the same day CISA added the flaw to its Known Exploited Vulnerabilities catalog with a due date of 3 September 2024 for federal agencies.

Why does an admin-to-kernel bug matter?

The National Vulnerability Database scores the flaw 7.8 with a local attack vector and low privileges required, and lists a use-after-free weakness (CWE-416). That means the attacker must already run code on the machine. The value of the bug is what comes next: kernel-level access lets a rootkit such as FudModule switch off or blind security tools from inside the operating system. This is why the patch matters even though the flaw cannot be triggered from the internet on its own.

Microsoft’s report on a separate North Korean campaign lists CVE-2024-38193 among the Windows fixes defenders should apply, and recommends turning on tamper protection and network protection in Microsoft Defender for Endpoint, running endpoint detection in block mode and enabling cloud-delivered antivirus protection.