CyberSecBulletin
CVE-2024-38202NVD status: Modified

Windows 10 Version 1809: Improper Access Control

Published Updated By the CyberSecBulletin desk

CVE-2024-38202 is a high-severity improper access control vulnerability in Windows 10 Version 1809 from Microsoft, with a CVSS 3.1 base score of 7.3 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, but only if a user takes part, for example by opening a link or file. The record lists version 10.0.17763.6414 as the first without the flaw, so updating Windows 10 Version 1809 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.68% chance of exploitation within 30 days, higher than 77% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Windows 10 Version 1809 to 10.0.17763.6414 or a later version.
  2. Update Windows Server 2019 to 10.0.17763.6414 or a later version.
  3. Update Windows Server 2019 (Server Core installation) to 10.0.17763.6414 or a later version.
  4. Read the advisory on msrc.microsoft.com for workarounds and exact fixed builds.
  5. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
MicrosoftWindows 10 Version 180910.0.17763.0 up to, but not including, 10.0.17763.641410.0.17763.6414
MicrosoftWindows Server 201910.0.17763.0 up to, but not including, 10.0.17763.641410.0.17763.6414
MicrosoftWindows Server 2019 (Server Core installation)10.0.17763.0 up to, but not including, 10.0.17763.641410.0.17763.6414
MicrosoftWindows Server 202210.0.20348.0 up to, but not including, 10.0.20348.276210.0.20348.2762
MicrosoftWindows 11 version 21H210.0.0 up to, but not including, 10.0.22000.326010.0.22000.3260
MicrosoftWindows 10 Version 21H210.0.19043.0 up to, but not including, 10.0.19044.501110.0.19044.5011
MicrosoftWindows 11 version 22H210.0.22621.0 up to, but not including, 10.0.22621.431710.0.22621.4317
MicrosoftWindows 10 Version 22H210.0.19045.0 up to, but not including, 10.0.19045.501110.0.19045.5011
MicrosoftWindows 11 version 22H310.0.22631.0 up to, but not including, 10.0.22631.431710.0.22631.4317
MicrosoftWindows 11 Version 23H210.0.22631.0 up to, but not including, 10.0.22631.431710.0.22631.4317
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)10.0.25398.0 up to, but not including, 10.0.25398.118910.0.25398.1189
MicrosoftWindows 10 Version 160710.0.14393.0 up to, but not including, 10.0.14393.742810.0.14393.7428
MicrosoftWindows Server 201610.0.14393.0 up to, but not including, 10.0.14393.742810.0.14393.7428
MicrosoftWindows Server 2016 (Server Core installation)10.0.14393.0 up to, but not including, 10.0.14393.742810.0.14393.7428
MicrosoftWindows 10 1607Not specified in the recordNot stated
MicrosoftWindows 10 1809Not specified in the recordNot stated
MicrosoftWindows 10 21h2Not specified in the recordNot stated
MicrosoftWindows 10 22h2Not specified in the recordNot stated
MicrosoftWindows 11 21h2Not specified in the recordNot stated
MicrosoftWindows 11 22h2Not specified in the recordNot stated
MicrosoftWindows 11 23h2Not specified in the recordNot stated
MicrosoftWindows Server 2022 23h2Not specified in the recordNot stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
RequiredA user must take an action such as opening a file or link.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Scored by CNA (microsoft.com).

Official description

Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS). However, an attacker attempting to exploit this vulnerability requires additional interaction by a privileged user to be successful. Microsoft has developed a security update to mitigate this threat which was made available October 08, 2024 and is provided in the Security Updates table of this CVE for customers to download. Note: Depending on your version of Windows, additional steps may be required to update Windows Recovery Environment (WinRE) to be protected from this vulnerability. Please refer to the FAQ section for more information. Guidance for customers who cannot immediately implement the update is provided in the Recommended Actions section of this CVE to help reduce the risks associated with this vulnerability and to protect their systems. If there are any further updates regarding mitigations for this vulnerability, this CVE will be updated and customers will be notified. We highly encourage customers to subscribe to Security Update Guide notifications to receive an alert if an update occurs. Details A security researcher informed Microsoft of an elevation of privilege vulnerability in Windows Update potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of VBS. For exploitation to succeed, an attacker must trick or convince an Administrator or a user with delegated permissions into performing a system restore which inadvertently triggers the vulnerability. Microsoft has developed a security update to mitigate this threat which was made available October 08, 2024 and is provided in the Security Updates table of this CVE for customers to download. Note: Depending on your version of Windows, additional steps may be required to update Windows Recovery Environment (WinRE) to be protected from this vulnerability. Please refer to the FAQ section for more information. Guidance for customers who cannot immediately implement the update is provided in the Recommended Actions section of this CVE to help reduce the risks associated with this vulnerability and to protect their systems. If there are any further... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38202

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How developers prevent this class of flaw

  • Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
  • Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

More Improper Access Control vulnerabilities (CWE-284)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Access Control vulnerabilities

Spotted an error? Tell us.