VERT Threat Alert: August 2024 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s August 2024 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-1119 as soon as coverage is completed.

In-The-Wild & Disclosed CVEs

CVE-2024-38178

CVE-2024-38178 describes a vulnerability in the Microsoft Edge scripting engine when run in Internet Explorer Mode. On top of requiring Edge be running in Internet Explorer Mode, an attacker must convince a user to click on a link to load the malicious code. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-38193

A vulnerability in the Windows Ancillary Function Driver for WinSock could allow attackers to gain SYSTEM privileges. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-38213

Windows uses the Mark of the Web (MoTW) to identify files downloaded from the Internet. This is done by setting the NTFS Zone.Identifier alternate Data Stream (ADS). This mark is used to notify users via SmartScreen that they are about to run a potentially dangerous file. This vulnerability allows malicious files to bypass SmartScreen. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-38106

This vulnerability, a privilege escalation in the Windows Kernel, requires that the attacker win a race condition to successfully exploit it. Successfully winning the race condition would allow the attacker to gain SYSTEM level access. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-38107

CVE-2024-38107 is a vulnerability in the Windows Power Dependency Coordinator, which is responsible for managing power usage including waking from sleep mode. This vulnerability, which has seen active exploitation, could grant an attacker SYSTEM privileges. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-38189

This vulnerability in Microsoft Project, which is seeing active exploitation, is only exploitable on systems where users have disabled the mitigation protections that should prevent exploitation. Microsoft has suggested that if you did disable mitigations, that you should at least enable VBA Macro notifications. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2024-38199

An unauthenticated attacker could send a print task across the network to the Windows Line Printer Daemon (LPD), triggering code execution on the server. The Windows LPD has been deprecated since Windows Server 2012 and is disabled by default, which mitigates the risk of this vulnerability. Admins should confirm that they have not enabled Windows LPD and either disable it immediately or install today’s update if they have. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE-2024-38200

While updates for CVE-2024-38200 were released as part of the August Patch Tuesday drop, Microsoft had already enabled a fix for this issue on July 30, meaning that all users of supported versions of Office were protected. Microsoft still recommends installing the August patch to be completely protected. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE-2024-21302

This vulnerability, released at BlackHat, allows attackers to perform a downgrade attack against Windows system files and has gotten quite a bit of press attention. Successful exploitation against Windows systems supporting Virtualization Based Security (VBS) allows the attacker to reintroduce vulnerabilities, circumvent VBS security, and exfiltrated data protected by VBS. Microsoft has released an opt-in mitigation in the August security update. Before opting in to the mitigation, it is recommended that administrators review the associated KB to understand the risks associated with applying this mitigation. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE-2024-38202

This vulnerability was disclosed alongside CVE-2024-21302. This allows a low privilege user to reintroduce vulnerabilities or bypass some VBS features. To successfully attack this, the low privilege user must convince someone with appropriate permissions to perform a system restore, which will trigger this vulnerability. Currently, no updates or mitigations are available. Microsoft has reported this vulnerability as Exploitation Less Likely.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also color coded to aid with identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be highlighted

Other Information

At the time of publication, there were no new advisories included with the August Security Guidance.