Critical Windows Vulnerability – PoC for CVE-2024-43452 Now Available

Just days into the new year, and we’re already facing the second significant Windows exploit of 2024. A Proof of Concept (PoC) exploit for CVE-2024-43452, a critical Windows Registry Elevation of Privilege vulnerability (CVSS 7.5), has been released, impacting Windows 11 23H2.

What You Need to Know:

• Discovered By: This vulnerability was uncovered by Mateusz Jurczyk from Google Project Zero, who built on the work of Gabriel Landau concerning registry vulnerabilities.
• Root Cause: The issue stems from a flaw in Windows registry hive memory management, specifically related to double-fetch operations.
• Security Risk: Attackers can exploit this flaw to escalate privileges to SYSTEM level by corrupting the registry structure through malicious SMB server responses.

How the Exploit Works:

Attack Process:

• Malicious Setup: The attacker hosts a rogue registry hive on a remote SMB server.
• Memory Eviction: The target system fetches and evicts memory pages, encountering specific memory constraints.
• Corruption: The malicious SMB server manipulates responses, which corrupt the registry structure, leading to potential SYSTEM-level access.

Environment Details:

The PoC was tested on Windows 11 23H2, using the July 2024 patches. Exploitation depends on memory consumption and layout, meaning successful exploitation may require some tuning or retries.

Microsoft’s Response:

Microsoft has already addressed this vulnerability in the November 2024 Patch Tuesday security updates. It’s essential to apply these patches immediately to minimize exposure to this risk.

Steps You Should Take:

• Patch Your Systems: Ensure all systems are fully updated with the latest security patches.
• Monitor SMB Traffic: Take a proactive approach in monitoring and restricting SMB connections to minimize exploitation risks.
• Control Registry Access: Implement strict access policies for registry-related operations to limit unauthorized changes.
• Check Memory Usage: For researchers, adjust memory usage as needed when investigating this vulnerability.

Why This Exploit Is So Serious:

This vulnerability underscores the critical risks of false file immutability in operating systems and emphasizes the need to address architectural flaws. Gaining SYSTEM-level access puts any affected system at significant risk, so rapid response is crucial.

A Vital Reminder:

Once a PoC is made public, malicious actors can quickly adapt and improve their exploitation techniques. The longer you delay patching, the higher the chance this vulnerability will be exploited at scale.

---

Helpful Links:

• LinkedIn Post by JP Castro
• Google Project Zero Issue