Security readout for executives and security teams
Plain-English summary
This Windows kernel flaw can let a user or intruder who already has limited local access gain powerful system privileges. Successful exploitation could enable data theft, security-control tampering, or full host compromise. CISA lists it as known exploited, making unpatched affected Windows endpoints and servers an urgent concern.
Executive priority
Treat as an accelerated remediation item. Known exploitation and potential kernel-level compromise outweigh the local-access prerequisite. Establish ownership, patch affected systems promptly, and require evidence of deployment and follow-up monitoring, especially for high-value endpoints and servers.
Technical view
CVE-2024-21338 is a Windows kernel elevation-of-privilege vulnerability classified as CWE-822. Its CVSS 3.1 score is 7.8: local access and low privileges are required, but no user interaction is needed. Successful exploitation can cause high confidentiality, integrity, and availability impact. Microsoft identifies security updates through its advisory.
Likely exposure
Exposure is most likely on affected Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022 systems missing Microsoft's applicable security update. The supplied version list should guide initial inventory, but Microsoft guidance should determine exact applicability and update status.
Exploitation context
Active exploitation is supported by CISA's Known Exploited Vulnerabilities catalog. Avast attributes zero-day use to Lazarus in connection with the FudModule rootkit. Public exploit references are also supplied, although this bundle does not establish their reliability or applicability to every affected version.
Researcher notes
The vector indicates local, low-complexity exploitation by a low-privileged actor without user interaction. CWE-822 identifies an untrusted pointer dereference, but the supplied metadata does not describe the precise vulnerable code path. Review Microsoft's advisory and Avast's analysis for authoritative technical context; avoid assuming all public samples work universally.
Mitigation direction
- Apply Microsoft's applicable security update for each affected Windows version.
- Prioritize internet-facing, privileged-user, administrator, and security-sensitive Windows systems.
- Use Microsoft guidance to address systems that cannot be patched immediately.
- Restrict unnecessary local access until remediation is verified.
Validation and detection
- Inventory listed Windows editions and compare their patch status with Microsoft's advisory.
- Confirm the applicable Microsoft update installed successfully and remains present after reboot.
- Review endpoint telemetry for unexpected privilege escalation or kernel-level security-control tampering.
- Investigate exposed systems using vendor-provided detections or indicators; none are supplied in this bundle.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-822: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-21338 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C1.85.9microsoftVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2024-21338 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2024-03-04T00:00:00.000Z: CVE-2024-21338 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- Windows Kernel Elevation of Privilege VulnerabilityCVE reference, microsoft · vendor-advisory, patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21338CVE reference, CISA-ADP · government-resource
- https://www.exploit-db.com/exploits/52275CVE reference, CVE
- https://packetstorm.news/files/id/190586/CVE reference, CVE
- https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/CVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Untrusted Pointer Dereference
Untrusted Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.